Overview

overview

10

Static

static

10

2026-08-15...ch.exe

windows10-2004-x64

1

2026-08-15...ch.exe

windows11-ltsc_2024-x64

1

Analysis

  • max time kernel
    148s
  • max time network
    147s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    15/08/2026, 08:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-15_ec2470989b199a4248b70cf32e64c716_coinminer_dosia_glassworm_malwareactor_omgwtfbbqapt_poet-rat_quasar-rat_snatch.exe
  • Size 10.2MB
  • Sample260815-kphv3sserd
  • SHA256 eee6786972ef9ad7fb5a4031637f9f7f591afe49c8f92c4ad0ca10d6be2e2e98
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-15_ec2470989b199a4248b70cf32e64c716_coinminer_dosia_glassworm_malwareactor_omgwtfbbqapt_poet-rat_quasar-rat_snatch.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-15_ec2470989b199a4248b70cf32e64c716_coinminer_dosia_glassworm_malwareactor_omgwtfbbqapt_poet-rat_quasar-rat_snatch.exe"
    1⤵
      PID:5972

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          .statekey
          • Path C:\Users\Admin\.cache\dataplane\.statekey
          • Size 32B
          • SHA256 c0549be2ded23c48f4dbb511a09a29873a788bd2888aee64bc2a4e30b23c0b6c
          • MD5 SHA1 SHA512
          Submit Download

          users.json.hw
          • Path C:\Users\Admin\AppData\Local\Temp\TestAccountRehashOnLogin1495448822\001\users.json.hw
          • Size 96B
          • SHA256 32dd51cbe78ae036beecf6eafeade75c478687aa3b9277fb082d6c58c0e548a9
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          u.json.hw
          • Path C:\Users\Admin\AppData\Local\Temp\TestAccountStoreCRUD950521980\001\u.json.hw
          • Size 96B
          • SHA256 a52a4108a8684146ffa11dd1f313791afa9540da7b0b98a565581bf90e0a70a9
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          .state_signed
          • Path C:\Users\Admin\AppData\Local\Temp\TestAdminNoStoreHeaders3243041424\001\.state_signed
          • Size 25B
          • SHA256 c50576a889c342d495e73d244cd122f4467f00cb9944db3e0eb269b43160c70b
          • MD5 SHA1 SHA512
          Submit Download

          audit.jsonl
          • Path C:\Users\Admin\AppData\Local\Temp\TestAuditAnchoredAfterRotation3718371609\001\audit.jsonl
          • Size 83B
          • SHA256 94c09860aec4fb46dfbb6ced56a1f4ab65054271765b400ab269ccbcf6e80022
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          audit.jsonl.head
          • Path C:\Users\Admin\AppData\Local\Temp\TestAuditAnchoredAfterRotation3718371609\001\audit.jsonl.head
          • Size 147B
          • SHA256 0f5ca7c11de97e945f4aa6bd71b2cc8087a8caeaee3038122705c4474c74e53a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          audit.jsonl
          • Path C:\Users\Admin\AppData\Local\Temp\TestAuditExportFullTrail2602859199\001\audit.jsonl
          • Size 549B
          • SHA256 0cd420ff6fe01d163a99daf054507b1a7cda01d1a4c7039ae8e32276e1b40789
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          audit.jsonl
          • Path C:\Users\Admin\AppData\Local\Temp\TestAuditTailTruncationDetected1334375234\001\audit.jsonl
          • Size 339B
          • SHA256 0a23437c10f37ce75f21fcc5c219bef2330a5d606af7645cdeebb42be2adbd85
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          .statekey
          • Path C:\Users\Admin\AppData\Local\Temp\TestCampaignsAndSTIX3985144728\001\.statekey
          • Size 32B
          • SHA256 35a439aa35f5f82030a778f8a9e0f1a541384e197ba5bc6ff36386f41498d588
          • MD5 SHA1 SHA512
          Submit Download

          admin_audit.jsonl
          • Path C:\Users\Admin\AppData\Local\Temp\TestConfigSaveSpamHTTP2200572787\001\admin_audit.jsonl
          • Size 6KB
          • SHA256 222a970d86c8617529ab33e4b8ff607189fcf92bd7ae5acea2224ce8cc218091
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          admin_audit.jsonl.head.tmp.5972
          • Path C:\Users\Admin\AppData\Local\Temp\TestConfigSaveSpamHTTP2200572787\001\admin_audit.jsonl.head.tmp.5972
          • Size 147B
          • SHA256 e8d00e8326aefc05d40c32598fd4b11c14c15061c6ae46513762ec482143d2c8
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          admin_audit.jsonl.head.tmp.5972
          • Path C:\Users\Admin\AppData\Local\Temp\TestConfigSaveSpamHTTP2200572787\001\admin_audit.jsonl.head.tmp.5972
          • Size 147B
          • SHA256 3be2860b2a8cfbf4089511773fb7bf50ae2626367204e457786f4d3bfed48d26
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          pending_changes.json
          • Path C:\Users\Admin\AppData\Local\Temp\TestConfigSaveSpamHTTP2200572787\001\pending_changes.json
          • Size 4KB
          • SHA256 a6277d7b0ed6810fb6383cb6ae802ea1507174b7042808f016774bb696d8ad9b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          .statekey
          • Path C:\Users\Admin\AppData\Local\Temp\TestDecoyAuthGate3871580276\001\.statekey
          • Size 32B
          • SHA256 f11d9a8cba6c1bfc3387598b3b8dce4847323d889ccd70aac9af5dbf11a4f0f8
          • MD5 SHA1 SHA512
          Submit Download

          .statekey
          • Path C:\Users\Admin\AppData\Local\Temp\TestDecoyClosedRoutes3642378860\001\.statekey
          • Size 32B
          • SHA256 fa051b7594312f837a05f7d9fd7f004de7a4368f8dc407451a26ebbad3b9bb9a
          • MD5 SHA1 SHA512
          Submit Download

          .statekey
          • Path C:\Users\Admin\AppData\Local\Temp\TestDecoyCookieIsCanary813562130\001\.statekey
          • Size 32B
          • SHA256 ee080637c0c1de4f4d839a24e52b52d3fffa4d093089c2ce4a32a7e5633399d7
          • MD5 SHA1 SHA512
          Submit Download

          .statekey
          • Path C:\Users\Admin\AppData\Local\Temp\TestDecoyCredentialBoundSuccess2569334788\001\.statekey
          • Size 32B
          • SHA256 aa2f0946a78189d12f50513acf5bd4153d387ac5c924465298ab495582ec3519
          • MD5 SHA1 SHA512
          Submit Download

          .statekey
          • Path C:\Users\Admin\AppData\Local\Temp\TestDecoyHoneytokenAssets720043405\001\.statekey
          • Size 32B
          • SHA256 5e659223a743cf07a496347fe0f5f11786ba294db51cee986f6b9d61da18cf64
          • MD5 SHA1 SHA512
          Submit Download

          .statekey
          • Path C:\Users\Admin\AppData\Local\Temp\TestDecoyInfraHarvest1987485272\001\.statekey
          • Size 32B
          • SHA256 34bfc3362fe0a9dac6629147c34bd680b2689b5298ded6f4cb472913402c2b8d
          • MD5 SHA1 SHA512
          Submit Download

          .statekey
          • Path C:\Users\Admin\AppData\Local\Temp\TestDecoyIntelSanitization702263729\001\.statekey
          • Size 32B
          • SHA256 99a26ee377a34b221a28f176d57c03e47a52467d728ef75ae16aa6c2066819b5
          • MD5 SHA1 SHA512
          Submit Download

          .statekey
          • Path C:\Users\Admin\AppData\Local\Temp\TestDecoyPerBootMetrics3117643529\001\.statekey
          • Size 32B
          • SHA256 6b934a1f7fcb2f05b790809c54979693931a155f3272e333fc3941c1d724b0ac
          • MD5 SHA1 SHA512
          Submit Download

          .statekey
          • Path C:\Users\Admin\AppData\Local\Temp\TestDecoyScanAndSupport446111452\001\.statekey
          • Size 32B
          • SHA256 7f7e750a051edc43b781f7fec986a22c085eba542833782f2840ffc494597671
          • MD5 SHA1 SHA512
          Submit Download

          .statekey
          • Path C:\Users\Admin\AppData\Local\Temp\TestDecoySchemaUnified3265438958\001\.statekey
          • Size 32B
          • SHA256 b64013f11134ba5df7a252d1f41fcc48709b395bf614ed3d32ab6acff9a5bd66
          • MD5 SHA1 SHA512
          Submit Download

          .statekey
          • Path C:\Users\Admin\AppData\Local\Temp\TestDecoyStatefulTheatre2535092375\001\.statekey
          • Size 32B
          • SHA256 0db5f1b710350420083f70b88d385cc8cab80aa90c6aabc0322ebb216cbe85f9
          • MD5 SHA1 SHA512
          Submit Download

          .statekey
          • Path C:\Users\Admin\AppData\Local\Temp\TestDecoyTarpitOff905335872\001\.statekey
          • Size 32B
          • SHA256 94d4f6fa719a3314fbf24d763a82e11d569ef605bfc4a3f88f52d6f0d25f7580
          • MD5 SHA1 SHA512
          Submit Download

          .statekey
          • Path C:\Users\Admin\AppData\Local\Temp\TestDecoyVerificationProbeDetector3126452081\001\.statekey
          • Size 32B
          • SHA256 e6aab2cbf010bf32223342cd429d4329732bd951c34c6cc1459ad207c07949bf
          • MD5 SHA1 SHA512
          Submit Download

          .statekey
          • Path C:\Users\Admin\AppData\Local\Temp\TestHoneypotBypassForOperator1947929793\001\.statekey
          • Size 32B
          • SHA256 7eed25839b1a7118dbf73a4ef6e471e798e9c4acbaed648cbdda619dc356ffb8
          • MD5 SHA1 SHA512
          Submit Download

          .statekey
          • Path C:\Users\Admin\AppData\Local\Temp\TestHoneypotDecoyIsInert2427977916\001\.statekey
          • Size 32B
          • SHA256 0e6a30a26844bc7e3f72a289fc47ed8354dc5b5bd1f4a47d4d7d080fca430fa2
          • MD5 SHA1 SHA512
          Submit Download

          .statekey
          • Path C:\Users\Admin\AppData\Local\Temp\TestHoneypotFakeSuccess3994726105\001\.statekey
          • Size 32B
          • SHA256 7690a0792d3d98392f466234a8fcefe54e40bae2a870fc902ac273f7d231c06f
          • MD5 SHA1 SHA512
          Submit Download

          .statekey
          • Path C:\Users\Admin\AppData\Local\Temp\TestHoneypotTrapDivertsToDecoy3448186501\001\.statekey
          • Size 32B
          • SHA256 0004b99ef0449dadb3ec881883e0307c4cba9e6226c92bd7a0c491e672215ec8
          • MD5 SHA1 SHA512
          Submit Download

          .statekey
          • Path C:\Users\Admin\AppData\Local\Temp\TestLoginFlow1979264412\001\.statekey
          • Size 32B
          • SHA256 d91469a1204df07bea0af61799ba100272765d06647073feb4db3c304fe2babb
          • MD5 SHA1 SHA512
          Submit Download

          state.json
          • Path C:\Users\Admin\AppData\Local\Temp\TestPresetEndpoints584171311\001\state.json
          • Size 16KB
          • SHA256 8942c04ecc248a9b1a756b703ff5c84104e64dd1649904d879901735092a380b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          .statekey
          • Path C:\Users\Admin\AppData\Local\Temp\TestPrivEscViaLegacyPassword2907246913\001\.statekey
          • Size 32B
          • SHA256 a45f0cce48a6298d24df0cb2f845852e263301a747fc46aa3c7e0df37d224b08
          • MD5 SHA1 SHA512
          Submit Download

          state.json
          • Path C:\Users\Admin\AppData\Local\Temp\TestPrivEscViaLegacyPassword2907246913\001\state.json
          • Size 16KB
          • SHA256 8487bb9229875c0181f0d13998c75355d935f217d7e04b51670f4279c0f8193c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          profile.json
          • Path C:\Users\Admin\AppData\Local\Temp\TestProfileStealthEndpoints2765233241\001\profile.json
          • Size 48B
          • SHA256 13fd73baa9c41d2868efaf4f1fc53402d339e412bda76b8ee509174076d513ba
          • MD5 SHA1 SHA512
          Submit Download

          profile.json
          • Path C:\Users\Admin\AppData\Local\Temp\TestProfileStealthEndpoints2765233241\001\profile.json
          • Size 49B
          • SHA256 583ef493052f33ccffd08772250b3b1411ca23d9497782d1d2fb6af4474635e4
          • MD5 SHA1 SHA512
          Submit Download

          .state_signed
          • Path C:\Users\Admin\AppData\Local\Temp\TestReportSummaryNeverLeaksAPlaceholder2287818685\005\.state_signed
          • Size 25B
          • SHA256 5f2dd24fb1e05a54c934a64b004facf3809ef7e191063a0ab122884db7b46832
          • MD5 SHA1 SHA512
          Submit Download

          .statekey
          • Path C:\Users\Admin\AppData\Local\Temp\TestStateSnapshotEndpoint1381006350\001\.statekey
          • Size 32B
          • SHA256 3d578f9e00fb510b982b6078c28ef3f4171e5e9a79844e4eeca0213e12ec3f21
          • MD5 SHA1 SHA512
          Submit Download

          blocklist.json.hw
          • Path C:\Users\Admin\AppData\Local\Temp\TestStateSnapshotEndpoint1381006350\001\blocklist.json.hw
          • Size 96B
          • SHA256 5be51d0d027ef6eedcfd72d9daae432050b96139c4ec116c7b733061b285375f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          profile.json
          • Path C:\Users\Admin\AppData\Local\Temp\TestStealthCoverNameEscapedInHTML2163438358\001\profile.json
          • Size 61B
          • SHA256 017c04e71483e0c0f580830512796fb9269485bbeddd8c3453ae194b0ec95e21
          • MD5 SHA1 SHA512 TLSH
          Submit Download