ecfca5c571e4cbaa129ad47d22213e339f70c69e58e49824b333538a5aa28adc

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 08:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_f7b35486b26d4a1ac0da814a1dd4259d_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
Size 24.8MB
Sample260810-jw22vsdn5v
SHA256 ecfca5c571e4cbaa129ad47d22213e339f70c69e58e49824b333538a5aa28adc
MD5 f7b35486b26d4a1ac0da814a1dd4259d
SHA1 6b6a471829e31425e3ef151e710a2407921ad702
SHA512 2ed637165dabc4a24aef3225809093baf5a897478395954a9d6f60f443d601df6ead740f7b8eca30ce3e9df7535e6909cfdb0f7b76b4d1295b2b96eae0f8f4c4
SSDEEP 196608:Q7CMSENg27cKSJB73tFMCLC+MfuEJ4Rm0nsH:Q+MvlmOCLPMfpNQsH
TLSH
T155472A53E8A219D4C4EEC174CA72812BBE613C591B3863E71690F3242F3BFD09AB6755
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4776	powershell.exe
4656	powershell.exe
2292	powershell.exe
1784	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
4872	2026-08-10_f7b35486b26d4a1ac0da814a1dd4259d_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
4704	2026-08-10_f7b35486b26d4a1ac0da814a1dd4259d_coinminer_dosia_poet-rat_quasar-rat_snatch.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4260	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4776	powershell.exe
4776	powershell.exe
4656	powershell.exe
4656	powershell.exe
2292	powershell.exe
2292	powershell.exe
1784	powershell.exe
1784	powershell.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
812	Process not Found

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4776	powershell.exe
Token: SeDebugPrivilege	4656	powershell.exe
Token: SeDebugPrivilege	2292	powershell.exe
Token: SeDebugPrivilege	1784	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3848 wrote to memory of 4260	3848	2026-08-10_f7b35486b26d4a1ac0da814a1dd4259d_coinminer_dosia_poet-rat_quasar-rat_snatch.exe	89
PID 3848 wrote to memory of 4872	3848	2026-08-10_f7b35486b26d4a1ac0da814a1dd4259d_coinminer_dosia_poet-rat_quasar-rat_snatch.exe	92
PID 4704 wrote to memory of 4776	4704	2026-08-10_f7b35486b26d4a1ac0da814a1dd4259d_coinminer_dosia_poet-rat_quasar-rat_snatch.exe	93
PID 4704 wrote to memory of 4656	4704	2026-08-10_f7b35486b26d4a1ac0da814a1dd4259d_coinminer_dosia_poet-rat_quasar-rat_snatch.exe	97
PID 4704 wrote to memory of 2292	4704	2026-08-10_f7b35486b26d4a1ac0da814a1dd4259d_coinminer_dosia_poet-rat_quasar-rat_snatch.exe	99
PID 4704 wrote to memory of 1784	4704	2026-08-10_f7b35486b26d4a1ac0da814a1dd4259d_coinminer_dosia_poet-rat_quasar-rat_snatch.exe	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-10_f7b35486b26d4a1ac0da814a1dd4259d_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_f7b35486b26d4a1ac0da814a1dd4259d_coinminer_dosia_poet-rat_quasar-rat_snatch.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3848
- C:\Windows\system32\schtasks.exe
  schtasks /Create /XML C:\Users\Admin\AppData\Local\Temp\2026-08-10_f7b35486b26d4a1ac0da814a1dd4259d_coinminer_dosia_poet-rat_quasar-rat_snatch_task.xml /TN 2026-08-10_f7b35486b26d4a1ac0da814a1dd4259d_coinminer_dosia_poet-rat_quasar-rat_snatch /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4260
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\2026-08-10_f7b35486b26d4a1ac0da814a1dd4259d_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\2026-08-10_f7b35486b26d4a1ac0da814a1dd4259d_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
  2⤵
  - Executes dropped EXE
  PID:4872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\2026-08-10_f7b35486b26d4a1ac0da814a1dd4259d_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\2026-08-10_f7b35486b26d4a1ac0da814a1dd4259d_coinminer_dosia_poet-rat_quasar-rat_snatch.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject -Query \"select Name from Win32_Processor\").Name"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4776
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject -Query \"Select Name from Win32_VideoController\").Name"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4656
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject -Query \"select * from Win32_OperatingSystem\").Caption"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2292
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject -Query \"select TotalPhysicalMemory from Win32_ComputerSystem\").TotalPhysicalMemory"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 693920388558483f180841310e37ea3f0b478d4649508d09fc90edb3361b714c
MD5 09b48127671fc158ffeffff668b0367b
SHA1 eb67454eadc9c0e14e925e9dab4027bd63d8499e
SHA512 1f182811ff70c9191e5ab903fe49bf1e0d6a6a1542b0712835fe5d55339838033797004680deab113c83dc9e5c143d8c0a48b0b656663b348aab0420704f59cb
TLSH
T174119B33F3CC8664C89A403650CAAC1036B687DB40CEDE9B7784D059A43F699CF61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 87038129440ee9b406f1ef3714f8d775dc8daf6e0178a4cbf6ba6d7287cf375c
MD5 86c515985383b8d8f6e2e3e827046e9f
SHA1 c7f5063450afe267cbbc88d54f4e917d8ca4873c
SHA512 c8755c824c50446c89e1e3234706639d52ac48cf848394ee8ca5b15a2266c92e3870be4c505dd7ea7a2a0d7f36861d11cafce07df3efc8eef0154a124e957c25
TLSH
T16F119733F3CC8664C89A413650CAAC1032B687DB408ECE9BBB84D054A43F699CE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 6b242aeacdf676ef5c9ae412b1ca4e3a9c9b3f4debd6d406231fb6224881c722
MD5 9fbf084c6f46d7e5d9646e7f9e963e53
SHA1 a04a82fe852254188f767f4521f2f6d2333478ae
SHA512 c768d7559bc6db05bc4a6e4f9ccc00ddcae93d9659a7f43834d5f405bd96c8b80e9fcc3e294b3aeb573885a5153d9e3b2316c651ded09271ccdbe95f622b9929
TLSH
T16C119B33B3CC8664C899403650CAAC1036B687DB40CECE9BB784D155A43F699CF61260
MD5 SHA1 SHA512 TLSH

Submit Download

2026-08-10_f7b35486b26d4a1ac0da814a1dd4259d_coinminer_dosia_poet-rat_quasar-rat_snatch_task.xml

Path C:\Users\Admin\AppData\Local\Temp\2026-08-10_f7b35486b26d4a1ac0da814a1dd4259d_coinminer_dosia_poet-rat_quasar-rat_snatch_task.xml
Size 1KB
SHA256 bf39807b2766acc9a1485f371419f2ed7c1be832d43945fcd0a0fecfdd6b1faf
MD5 041af2b886232537fe679e6d56148ad8
SHA1 91def5a457503d7f697381153434002b09ba926f
SHA512 9c14be16bd907c027ab1d41c85535839e341a2b9493364bb8970f5cd1fe284f90ea5551a6688c051bdbe3117f7daf913c7692eabe3983c985935a45ae613769a
TLSH
T1C42122904C14F61BB55A573ACB926382223E77FA46F14139D9CC4EBC68892C77142477
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_b0om0emj.y4h.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_b0om0emj.y4h.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

2026-08-10_f7b35486b26d4a1ac0da814a1dd4259d_coinminer_dosia_poet-rat_quasar-rat_snatch.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\2026-08-10_f7b35486b26d4a1ac0da814a1dd4259d_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
Size 24.8MB
SHA256 ecfca5c571e4cbaa129ad47d22213e339f70c69e58e49824b333538a5aa28adc
MD5 f7b35486b26d4a1ac0da814a1dd4259d
SHA1 6b6a471829e31425e3ef151e710a2407921ad702
SHA512 2ed637165dabc4a24aef3225809093baf5a897478395954a9d6f60f443d601df6ead740f7b8eca30ce3e9df7535e6909cfdb0f7b76b4d1295b2b96eae0f8f4c4
SSDEEP 196608:Q7CMSENg27cKSJB73tFMCLC+MfuEJ4Rm0nsH:Q+MvlmOCLPMfpNQsH
TLSH
T155472A53E8A219D4C4EEC174CA72812BBE613C591B3863E71690F3242F3BFD09AB6755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1784-29-0x0000019FF6710000-0x0000019FF683F000-memory.dmp

Download

memory/2292-24-0x000001E6F7D50000-0x000001E6F7E7F000-memory.dmp

Download

memory/4656-19-0x000002A09A880000-0x000002A09A9AF000-memory.dmp

Download

memory/4776-12-0x000001635ED10000-0x000001635ED32000-memory.dmp

Download

memory/4776-14-0x00000163774E0000-0x000001637760F000-memory.dmp

Download