abea6905051cee87a441c78e01fa746296ec1a4ad8d91f9f17bb365b48a05984

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 16:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_8fa9714259ec5dff360cb17cdac7dcce_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 7.0MB
Sample260809-tvq83shr51
SHA256 abea6905051cee87a441c78e01fa746296ec1a4ad8d91f9f17bb365b48a05984
MD5 8fa9714259ec5dff360cb17cdac7dcce
SHA1 a49907440583aec07bd6851dc09691db6ef40c05
SHA512 006c405a6f0f14de475ce3539ee71866008dbaa69f9b862d808ff2815c7db1adbc08a159d7a44520a99275e2ed931965c86deccbc2c6f10adb91ce4d4300e382
SSDEEP 98304:UZBAtuZhpGFXkR1RpaUZRumvBh8huTUE:Uw4ZhpK0R1RMq/
TLSH
T14F764907ECA554E9C0BEC17189639562BB717C485B3123D32B50F6382F76BE0AEBA750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

execution persistence

Malware Config

Signatures

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral2/files/0x000a000000019cb8-5.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Executes dropped EXE 2 IoCs

pid	Process
5972	2026-08-09_8fa9714259ec5dff360cb17cdac7dcce_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
4668	2026-08-09_8fa9714259ec5dff360cb17cdac7dcce_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3340	powershell.exe
4592	powershell.exe
4532	powershell.exe
4692	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2672	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3340	powershell.exe
3340	powershell.exe
4592	powershell.exe
4592	powershell.exe
4532	powershell.exe
4532	powershell.exe
4692	powershell.exe
4692	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3340	powershell.exe
Token: SeDebugPrivilege	4592	powershell.exe
Token: SeDebugPrivilege	4532	powershell.exe
Token: SeDebugPrivilege	4692	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5904 wrote to memory of 2672	5904	2026-08-09_8fa9714259ec5dff360cb17cdac7dcce_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	89
PID 5904 wrote to memory of 5972	5904	2026-08-09_8fa9714259ec5dff360cb17cdac7dcce_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	91
PID 5972 wrote to memory of 3340	5972	2026-08-09_8fa9714259ec5dff360cb17cdac7dcce_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	93
PID 5972 wrote to memory of 4592	5972	2026-08-09_8fa9714259ec5dff360cb17cdac7dcce_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	96
PID 5972 wrote to memory of 4532	5972	2026-08-09_8fa9714259ec5dff360cb17cdac7dcce_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	98
PID 5972 wrote to memory of 4692	5972	2026-08-09_8fa9714259ec5dff360cb17cdac7dcce_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	100

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-09_8fa9714259ec5dff360cb17cdac7dcce_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_8fa9714259ec5dff360cb17cdac7dcce_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5904
- C:\Windows\system32\schtasks.exe
  schtasks /Create /XML C:\Users\Admin\AppData\Local\Temp\2026-08-09_8fa9714259ec5dff360cb17cdac7dcce_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch_task.xml /TN 2026-08-09_8fa9714259ec5dff360cb17cdac7dcce_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2672
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\2026-08-09_8fa9714259ec5dff360cb17cdac7dcce_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\2026-08-09_8fa9714259ec5dff360cb17cdac7dcce_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5972
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject -Query \"select Name from Win32_Processor\").Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3340
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject -Query \"Select Name from Win32_VideoController\").Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4592
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject -Query \"select * from Win32_OperatingSystem\").Caption"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4532
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject -Query \"select TotalPhysicalMemory from Win32_ComputerSystem\").TotalPhysicalMemory"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4692

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\2026-08-09_8fa9714259ec5dff360cb17cdac7dcce_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\2026-08-09_8fa9714259ec5dff360cb17cdac7dcce_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Executes dropped EXE
PID:4668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 54aa570220e696de49a9a588711123e43032522c4578b6fa4f918d2666c1cb32
MD5 27db61c440595c38f5a7b661c618d0c9
SHA1 87613fdda39013791c068bdeec060f945fa2e908
SHA512 e367d57ce85719fa4e3cfd8083e0a5f71110b3f845c1ea7d3a0a3393066cfa90b96712701f044b731fab41ff6a751b7f4db794795c1f3aec955f642c3df25586
TLSH
T1FC115733F3CC8624C89A413650CEAC1036B587DB519ECE6BBB84D154B43F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 bcf8325db72c06bb7f6a8df3c4648a150d766a1857214c6b533c467029424ce8
MD5 e6bcee6109b84febc5ffa8c6d9b2a547
SHA1 eb5de5de4575f11fea9fb8a5f72aee1c8b5b3dab
SHA512 3081253140a770e4c68087b76b905286143feb2fbafa1e0b284b50f69ec736153f85fad9305d7e7f1309d98cf470edea4ab89da3941e068631116d03cccf5333
TLSH
T1C6115733B3CC8624CC9A403650CEAC1036B587DB509EDF6BBB84D145B83F599DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

2026-08-09_8fa9714259ec5dff360cb17cdac7dcce_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch_task.xml

Path C:\Users\Admin\AppData\Local\Temp\2026-08-09_8fa9714259ec5dff360cb17cdac7dcce_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch_task.xml
Size 1KB
SHA256 a9c392402793d245d0493c5a014ae65e7366198d46fa1d420ab0b48329534dcd
MD5 7ba0919e48b419cd3adf8b336d25136f
SHA1 33a06c1337a9e34f6755e0ecdbb32c27073c302b
SHA512 710252449a4a3ac00197d9b6876a77f8f8c926334beb2ce5bfa6a6ad5bfbc17fb389ae2e009d920bb2ab82b34fa086452e6e0d7f6a87b738262dbad1c75b5c1a
TLSH
T1DF2152A05C00F61BB557962ECB925782327EBBEA46A14038D9DC4DEC688A187611297B
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_2y5jpnc0.n3i.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2y5jpnc0.n3i.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

2026-08-09_8fa9714259ec5dff360cb17cdac7dcce_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\2026-08-09_8fa9714259ec5dff360cb17cdac7dcce_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 7.0MB
SHA256 abea6905051cee87a441c78e01fa746296ec1a4ad8d91f9f17bb365b48a05984
MD5 8fa9714259ec5dff360cb17cdac7dcce
SHA1 a49907440583aec07bd6851dc09691db6ef40c05
SHA512 006c405a6f0f14de475ce3539ee71866008dbaa69f9b862d808ff2815c7db1adbc08a159d7a44520a99275e2ed931965c86deccbc2c6f10adb91ce4d4300e382
SSDEEP 98304:UZBAtuZhpGFXkR1RpaUZRumvBh8huTUE:Uw4ZhpK0R1RMq/
TLSH
T14F764907ECA554E9C0BEC17189639562BB717C485B3123D32B50F6382F76BE0AEBA750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3340-10-0x0000025E2F770000-0x0000025E2F792000-memory.dmp

Download

memory/3340-12-0x0000025E2F940000-0x0000025E2FA6F000-memory.dmp

Download

memory/4532-22-0x000002CEDA490000-0x000002CEDA5BF000-memory.dmp

Download

memory/4592-17-0x0000021CE46D0000-0x0000021CE47FF000-memory.dmp

Download

memory/4692-27-0x000001CAE9F40000-0x000001CAEA06F000-memory.dmp

Download