782993c5ddf04b0d1a7aa9f31bb725770b7c62d7021f6826381bf8ade578a3a7

Analysis

max time kernel
150s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 16:03

Target
2026-08-09_bff1b4e82fe65bd36047ec22d856ca97_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 14.7MB
Sample260809-thn8ys1emf
SHA256 782993c5ddf04b0d1a7aa9f31bb725770b7c62d7021f6826381bf8ade578a3a7
MD5 bff1b4e82fe65bd36047ec22d856ca97
SHA1 b00c6ce6d10a9292cfe65a787707cf2cd68c4def
SHA512 cd5174d796e8d24066ed4743daa053205b36741f0a65fea39d505c666506c3f0f9f219a3d27559889d41bdec181a6cad23e695e2940b6dbb75149d39ab324076
SSDEEP 98304:6HSFBW3kdxL5geu3AugxunvZw+76LJ5D/OAEZdjoKKE7:6eYX1gknW+76LPDY7
TLSH
T1A4F64A47F8A515D6C0AED175CA669113BB727C894F3023D36B60F6282F32BD0AEB9744
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Discovers running processes 1 TTPs 4 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

Process Discovery

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

Wi-Fi Discovery

pid	Process
2376	netsh.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-08-09_bff1b4e82fe65bd36047ec22d856ca97_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-08-09_bff1b4e82fe65bd36047ec22d856ca97_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4960	2026-08-09_bff1b4e82fe65bd36047ec22d856ca97_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4960 wrote to memory of 3616	4960	2026-08-09_bff1b4e82fe65bd36047ec22d856ca97_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	89
PID 4960 wrote to memory of 5264	4960	2026-08-09_bff1b4e82fe65bd36047ec22d856ca97_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	92
PID 4960 wrote to memory of 4864	4960	2026-08-09_bff1b4e82fe65bd36047ec22d856ca97_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	94
PID 4960 wrote to memory of 1988	4960	2026-08-09_bff1b4e82fe65bd36047ec22d856ca97_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	96
PID 4960 wrote to memory of 2376	4960	2026-08-09_bff1b4e82fe65bd36047ec22d856ca97_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	98