43508dcd7c087c20761f3a24114d10edcaf7cf2d3d431f9123b8124bf6fa9c42

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 01:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_e57deb2ada7c1fd372814c44223ef791_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 7.0MB
Sample260810-b73tjayeqf
SHA256 43508dcd7c087c20761f3a24114d10edcaf7cf2d3d431f9123b8124bf6fa9c42
MD5 e57deb2ada7c1fd372814c44223ef791
SHA1 7dafc147f81574a742db3980e78059d66e76984e
SHA512 930424680bc561de60e86a23bfdbca3a2e00cbbd146d43e67a74da0cbdd81c684332a9dce9d34f31ac530aacfbc7bebe35b2950c697b57f2d3eceeed5bcee3ab
SSDEEP 98304:VkISn0iq1Jx/dzRi3CeaFOumvBh8huTlE:V00iq1JZJk3CFj
TLSH
T177763907ECA554E9C0AEC13189639562BF717C485B3123D32B50F6386F76BE0AEBA750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

execution persistence

Malware Config

Signatures

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral1/files/0x000600000001e6b8-5.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Executes dropped EXE 2 IoCs

pid	Process
4668	2026-08-10_e57deb2ada7c1fd372814c44223ef791_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
3880	2026-08-10_e57deb2ada7c1fd372814c44223ef791_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4004	powershell.exe
2424	powershell.exe
4896	powershell.exe
1104	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1300	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4004	powershell.exe
4004	powershell.exe
2424	powershell.exe
2424	powershell.exe
4896	powershell.exe
4896	powershell.exe
1104	powershell.exe
1104	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4004	powershell.exe
Token: SeDebugPrivilege	2424	powershell.exe
Token: SeDebugPrivilege	4896	powershell.exe
Token: SeDebugPrivilege	1104	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4020 wrote to memory of 1300	4020	2026-08-10_e57deb2ada7c1fd372814c44223ef791_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	86
PID 4020 wrote to memory of 4668	4020	2026-08-10_e57deb2ada7c1fd372814c44223ef791_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	89
PID 3880 wrote to memory of 4004	3880	2026-08-10_e57deb2ada7c1fd372814c44223ef791_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	90
PID 3880 wrote to memory of 2424	3880	2026-08-10_e57deb2ada7c1fd372814c44223ef791_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	93
PID 3880 wrote to memory of 4896	3880	2026-08-10_e57deb2ada7c1fd372814c44223ef791_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	95
PID 3880 wrote to memory of 1104	3880	2026-08-10_e57deb2ada7c1fd372814c44223ef791_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	97

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-10_e57deb2ada7c1fd372814c44223ef791_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_e57deb2ada7c1fd372814c44223ef791_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4020
- C:\Windows\system32\schtasks.exe
  schtasks /Create /XML C:\Users\Admin\AppData\Local\Temp\2026-08-10_e57deb2ada7c1fd372814c44223ef791_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch_task.xml /TN 2026-08-10_e57deb2ada7c1fd372814c44223ef791_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1300
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\2026-08-10_e57deb2ada7c1fd372814c44223ef791_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\2026-08-10_e57deb2ada7c1fd372814c44223ef791_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  2⤵
  - Executes dropped EXE
  PID:4668

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\2026-08-10_e57deb2ada7c1fd372814c44223ef791_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\2026-08-10_e57deb2ada7c1fd372814c44223ef791_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject -Query \"select Name from Win32_Processor\").Name"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4004
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject -Query \"Select Name from Win32_VideoController\").Name"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2424
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject -Query \"select * from Win32_OperatingSystem\").Caption"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4896
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject -Query \"select TotalPhysicalMemory from Win32_ComputerSystem\").TotalPhysicalMemory"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
MD5 6cf293cb4d80be23433eecf74ddb5503
SHA1 24fe4752df102c2ef492954d6b046cb5512ad408
SHA512 0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00
TLSH
T148510F323375F1E4C8567F071E68198053BF4395EA94AF5CB298621ED92741B8F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 b57d4cf5e1eee864debdd07645b7d3996ef1960b250716f7bff3f0aa368972f0
MD5 a71d6ebcd5d8bfd627a4f40af5d5ba6a
SHA1 24322d34e2b60054147ad356a6bd494c117d7cbc
SHA512 62c735eea8f166b89c45a149e79d6626e4ee5453368bd59404eceb146fe1ff2aeb36f4b37f46d7e9a1db52d73271a290e9e7cd1acb950fe793e7ae7bebe16ad1
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
MD5 446dd1cf97eaba21cf14d03aebc79f27
SHA1 36e4cc7367e0c7b40f4a8ace272941ea46373799
SHA512 a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
MD5 SHA1 SHA512

Submit Download

2026-08-10_e57deb2ada7c1fd372814c44223ef791_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch_task.xml

Path C:\Users\Admin\AppData\Local\Temp\2026-08-10_e57deb2ada7c1fd372814c44223ef791_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch_task.xml
Size 1KB
SHA256 358e7e3167017230f1c077e6eddd27333958b77a19c7f29300320669ffb5d249
MD5 0c21d85b8b8cc4d0efd9cbc7e7185a8d
SHA1 34da7e956d4e794b42528b4771490cade01cd679
SHA512 25fbbf74b778893b1abd021a108140c0b006313a35e00fa2b99496a171c5fba0ce0f830efb14f163c07b86d8a53a7f6284fb6cd7609d40c06fe29f4b545f0763
TLSH
T1E92154A04D10F61B75575B2ACB925383227EA7A64B608139D9C80CEC748E287A242577
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_eo21tl2e.5y3.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_eo21tl2e.5y3.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

2026-08-10_e57deb2ada7c1fd372814c44223ef791_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\2026-08-10_e57deb2ada7c1fd372814c44223ef791_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 7.0MB
SHA256 43508dcd7c087c20761f3a24114d10edcaf7cf2d3d431f9123b8124bf6fa9c42
MD5 e57deb2ada7c1fd372814c44223ef791
SHA1 7dafc147f81574a742db3980e78059d66e76984e
SHA512 930424680bc561de60e86a23bfdbca3a2e00cbbd146d43e67a74da0cbdd81c684332a9dce9d34f31ac530aacfbc7bebe35b2950c697b57f2d3eceeed5bcee3ab
SSDEEP 98304:VkISn0iq1Jx/dzRi3CeaFOumvBh8huTlE:V00iq1JZJk3CFj
TLSH
T177763907ECA554E9C0AEC13189639562BF717C485B3123D32B50F6386F76BE0AEBA750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1104-49-0x000002E26CCB0000-0x000002E26CDFE000-memory.dmp

Download

memory/2424-29-0x000002636CC20000-0x000002636CD6E000-memory.dmp

Download

memory/4004-15-0x000001FC7ED60000-0x000001FC7ED82000-memory.dmp

Download

memory/4004-18-0x000001FC7ED90000-0x000001FC7EEDE000-memory.dmp

Download

memory/4896-39-0x0000018E75030000-0x0000018E7517E000-memory.dmp

Download