8c8b24bf197b5dbc62c97f2b83903302ad40ad2f948fbace839388d29bc15746

General

Target
2026-08-15_fe29762a0c0ed07cf9e1496fbd477ae0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 16.2MB
Sample260815-dhm3wsde55
SHA256 8c8b24bf197b5dbc62c97f2b83903302ad40ad2f948fbace839388d29bc15746
MD5 fe29762a0c0ed07cf9e1496fbd477ae0
SHA1 94d2cd47dcddbeadaffd29a4de5bef1d39bd293c
SHA512 9d26a0a662a902d9fcecd087df27cffc14bb1a0fd462d002fa34ea9e7a0ef8860d09e8e7a22bf1a53236042af32e8d594f1b740a5acd355433726f8e98606cc0
SSDEEP 196608:rpH5HcqnOTeXqVXNNOZj83+zw//fnryPpCVSnjZBuUYwdf4:rJaqOTeXq1NYZj83n/frEp6MzuUYwd
TLSH
T1E8078D43E87506E9C0AD9276C6779653BA353C894B3163C35B90BA386F33BD0AEB5740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3092	cmd.exe
3420	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 4 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
3092	cmd.exe
4892	netsh.exe
3420	cmd.exe
2616	netsh.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-08-15_fe29762a0c0ed07cf9e1496fbd477ae0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-08-15_fe29762a0c0ed07cf9e1496fbd477ae0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4128 wrote to memory of 5456	4128	2026-08-15_fe29762a0c0ed07cf9e1496fbd477ae0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	88
PID 4128 wrote to memory of 3092	4128	2026-08-15_fe29762a0c0ed07cf9e1496fbd477ae0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	89
PID 3092 wrote to memory of 4892	3092	cmd.exe	91
PID 4128 wrote to memory of 3420	4128	2026-08-15_fe29762a0c0ed07cf9e1496fbd477ae0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	93
PID 3420 wrote to memory of 2616	3420	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-08-15_fe29762a0c0ed07cf9e1496fbd477ae0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_fe29762a0c0ed07cf9e1496fbd477ae0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:4128
- C:\Users\Admin\AppData\Local\Temp\2026-08-15_fe29762a0c0ed07cf9e1496fbd477ae0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-15_fe29762a0c0ed07cf9e1496fbd477ae0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --antikill-watchdog 4128
  2⤵
  PID:5456
- C:\Windows\system32\cmd.exe
  cmd.exe /c "netsh wlan show profiles"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Wi-Fi Discovery
  - Suspicious use of WriteProcessMemory
  PID:3092
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4892
- C:\Windows\system32\cmd.exe
  cmd.exe /c "netsh wlan show profiles"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Wi-Fi Discovery
  - Suspicious use of WriteProcessMemory
  PID:3420
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:2616