Analysis
- max time kernel
150s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/08/2026, 07:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-13_e83d20ac33fa070cfda21e47aa8d9976_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-13_e83d20ac33fa070cfda21e47aa8d9976_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Resource
win11ltsc2024-20260709-en
2 signatures
150 seconds
General
- Target 2026-08-13_e83d20ac33fa070cfda21e47aa8d9976_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
- Size 17.9MB
- Sample260813-jreqrsvclc
- SHA256 f2a9e589716e1d986d934761c518fb593b9acfc2ec8c100e5fead7e05e97a8e2
- MD5 e83d20ac33fa070cfda21e47aa8d9976
- SHA1 1cc5fb6489214a00655724b70f1cac340521104a
- SHA512 a5e4429852e892ebd36e13fc187ebb0357f7066060e35d5f9ef8328f0cad8d5d3de90e62ac5631709a1833f4f54da61c5c311bc6486b0f6d3153b33eee2ee94a
- SSDEEP 98304:FbblvzsoztwDzvd2fxMdCSlNMCF+y9k+WD7FGIxA8EMBTZ+F3+E:xtIozy1OeIu+Wk+WHcIulMqFL
- TLSH T14E174B13E86508E9C1EED130C9629613BB717C494B7163D75B60B6293F77BD0AEBA310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 5848 2026-08-13_e83d20ac33fa070cfda21e47aa8d9976_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 5848 2026-08-13_e83d20ac33fa070cfda21e47aa8d9976_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-13_e83d20ac33fa070cfda21e47aa8d9976_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-13_e83d20ac33fa070cfda21e47aa8d9976_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5848