a488e55994340491d837c2ca4f78c79c41593f6a64271de37095f452c557f09d

Analysis

max time kernel
149s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 22:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_502e6186363693c54553f6430bbfd30c_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 6.2MB
Sample260811-2sjefsem2v
SHA256 a488e55994340491d837c2ca4f78c79c41593f6a64271de37095f452c557f09d
MD5 502e6186363693c54553f6430bbfd30c
SHA1 1c7815237df7fa25830412870ad3373c857a2509
SHA512 25d1ee769322e1d43510ea22480bdc9f160ead155515376c97b1a5273ace469d93d7b53538950a888327b91549643142d83a8ba28ba5596257e70bc9c0c03f27
SSDEEP 49152:SNUYiyxxFh6wkEtaQWbtn+QsosaqAv3TYufeOMhnmKRGjtK9vo7KQK1K6svgJ5EP:SNnJvu0CvTYsCdfpEP
TLSH
T12C564A47EC6515E4C1AEE1318A679253BB61BC895B3123D32B90F7283F76BE0AD79340
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4080	powershell.exe
3852	powershell.exe
1460	powershell.exe
4416	powershell.exe
3176	powershell.exe
292	powershell.exe
3364	powershell.exe
5796	powershell.exe
1132	powershell.exe
2124	powershell.exe
3584	powershell.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
4080	powershell.exe
4080	powershell.exe
292	powershell.exe
292	powershell.exe
3364	powershell.exe
3364	powershell.exe
3852	powershell.exe
3852	powershell.exe
5796	powershell.exe
5796	powershell.exe
1132	powershell.exe
1132	powershell.exe
1460	powershell.exe
1460	powershell.exe
2124	powershell.exe
2124	powershell.exe
4416	powershell.exe
4416	powershell.exe
3584	powershell.exe
3584	powershell.exe
3176	powershell.exe
3176	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4080	powershell.exe
Token: SeIncreaseQuotaPrivilege	4080	powershell.exe
Token: SeSecurityPrivilege	4080	powershell.exe
Token: SeTakeOwnershipPrivilege	4080	powershell.exe
Token: SeLoadDriverPrivilege	4080	powershell.exe
Token: SeSystemProfilePrivilege	4080	powershell.exe
Token: SeSystemtimePrivilege	4080	powershell.exe
Token: SeProfSingleProcessPrivilege	4080	powershell.exe
Token: SeIncBasePriorityPrivilege	4080	powershell.exe
Token: SeCreatePagefilePrivilege	4080	powershell.exe
Token: SeBackupPrivilege	4080	powershell.exe
Token: SeRestorePrivilege	4080	powershell.exe
Token: SeShutdownPrivilege	4080	powershell.exe
Token: SeDebugPrivilege	4080	powershell.exe
Token: SeSystemEnvironmentPrivilege	4080	powershell.exe
Token: SeRemoteShutdownPrivilege	4080	powershell.exe
Token: SeUndockPrivilege	4080	powershell.exe
Token: SeManageVolumePrivilege	4080	powershell.exe
Token: 33	4080	powershell.exe
Token: 34	4080	powershell.exe
Token: 35	4080	powershell.exe
Token: 36	4080	powershell.exe
Token: SeDebugPrivilege	292	powershell.exe
Token: SeIncreaseQuotaPrivilege	292	powershell.exe
Token: SeSecurityPrivilege	292	powershell.exe
Token: SeTakeOwnershipPrivilege	292	powershell.exe
Token: SeLoadDriverPrivilege	292	powershell.exe
Token: SeSystemProfilePrivilege	292	powershell.exe
Token: SeSystemtimePrivilege	292	powershell.exe
Token: SeProfSingleProcessPrivilege	292	powershell.exe
Token: SeIncBasePriorityPrivilege	292	powershell.exe
Token: SeCreatePagefilePrivilege	292	powershell.exe
Token: SeBackupPrivilege	292	powershell.exe
Token: SeRestorePrivilege	292	powershell.exe
Token: SeShutdownPrivilege	292	powershell.exe
Token: SeDebugPrivilege	292	powershell.exe
Token: SeSystemEnvironmentPrivilege	292	powershell.exe
Token: SeRemoteShutdownPrivilege	292	powershell.exe
Token: SeUndockPrivilege	292	powershell.exe
Token: SeManageVolumePrivilege	292	powershell.exe
Token: 33	292	powershell.exe
Token: 34	292	powershell.exe
Token: 35	292	powershell.exe
Token: 36	292	powershell.exe
Token: SeDebugPrivilege	3364	powershell.exe
Token: SeIncreaseQuotaPrivilege	3364	powershell.exe
Token: SeSecurityPrivilege	3364	powershell.exe
Token: SeTakeOwnershipPrivilege	3364	powershell.exe
Token: SeLoadDriverPrivilege	3364	powershell.exe
Token: SeSystemProfilePrivilege	3364	powershell.exe
Token: SeSystemtimePrivilege	3364	powershell.exe
Token: SeProfSingleProcessPrivilege	3364	powershell.exe
Token: SeIncBasePriorityPrivilege	3364	powershell.exe
Token: SeCreatePagefilePrivilege	3364	powershell.exe
Token: SeBackupPrivilege	3364	powershell.exe
Token: SeRestorePrivilege	3364	powershell.exe
Token: SeShutdownPrivilege	3364	powershell.exe
Token: SeDebugPrivilege	3364	powershell.exe
Token: SeSystemEnvironmentPrivilege	3364	powershell.exe
Token: SeRemoteShutdownPrivilege	3364	powershell.exe
Token: SeUndockPrivilege	3364	powershell.exe
Token: SeManageVolumePrivilege	3364	powershell.exe
Token: 33	3364	powershell.exe
Token: 34	3364	powershell.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4464 wrote to memory of 4080	4464	2026-08-11_502e6186363693c54553f6430bbfd30c_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	90
PID 4464 wrote to memory of 292	4464	2026-08-11_502e6186363693c54553f6430bbfd30c_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	92
PID 4464 wrote to memory of 3364	4464	2026-08-11_502e6186363693c54553f6430bbfd30c_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	93
PID 4464 wrote to memory of 3852	4464	2026-08-11_502e6186363693c54553f6430bbfd30c_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	94
PID 4464 wrote to memory of 5796	4464	2026-08-11_502e6186363693c54553f6430bbfd30c_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	95
PID 4464 wrote to memory of 1132	4464	2026-08-11_502e6186363693c54553f6430bbfd30c_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	96
PID 4464 wrote to memory of 1460	4464	2026-08-11_502e6186363693c54553f6430bbfd30c_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	97
PID 4464 wrote to memory of 2124	4464	2026-08-11_502e6186363693c54553f6430bbfd30c_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	98
PID 4464 wrote to memory of 4416	4464	2026-08-11_502e6186363693c54553f6430bbfd30c_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	99
PID 4464 wrote to memory of 3584	4464	2026-08-11_502e6186363693c54553f6430bbfd30c_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	100
PID 4464 wrote to memory of 3176	4464	2026-08-11_502e6186363693c54553f6430bbfd30c_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-11_502e6186363693c54553f6430bbfd30c_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_502e6186363693c54553f6430bbfd30c_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4464
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_Processor).Name"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4080
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_Processor | Select-Object -First 1).NumberOfCores"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:292
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_Processor | Select-Object -First 1).NumberOfLogicalProcessors"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3364
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_Processor | Select-Object -First 1).MaxClockSpeed"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3852
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_VideoController | Select-Object -First 1).Name"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5796
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_VideoController | Select-Object -First 1).DriverVersion"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1132
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_VideoController | Select-Object -First 1).AdapterRAM"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1460
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_OperatingSystem).Caption"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2124
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_OperatingSystem).Version"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4416
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "Get-CimInstance Win32_LogicalDisk | ForEach-Object { \"$($_.DeviceID)|$($_.FileSystem)|$($_.FreeSpace)|$($_.Size)|$($_.DriveType)\" }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3584
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "Get-CimInstance Win32_DiskDrive | Sort-Object Index | ForEach-Object { $_.Model }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3176

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact