Analysis
- max time kernel
148s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
16/08/2026, 00:40
General
- Target 2026-08-15_4379e277b168ccee3923c1b10ba4dcc3_cobalt-strike_coinminer_dosia_glassworm_luca-stealer_poet-rat_quasar-rat.exe
- Size 6.7MB
- Sample260816-az78lsxthx
- SHA256 c15aead19e0d6e8ed51de79a858d7ef6b5ede226c7db79e7008a23b3445c164d
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Creates a file in the Startup directory 1 TTPs 1 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Modifies trusted root certificate store through registry 1 TTPs 2 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
- Modifies system certificate store 2 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-15_4379e277b168ccee3923c1b10ba4dcc3_cobalt-strike_coinminer_dosia_glassworm_luca-stealer_poet-rat_quasar-rat.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-15_4379e277b168ccee3923c1b10ba4dcc3_cobalt-strike_coinminer_dosia_glassworm_luca-stealer_poet-rat_quasar-rat.exe"1⤵
- Modifies trusted root certificate store through registry
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\create_lnk_2105720784.ps12⤵
- Command and Scripting Interpreter: PowerShell
- Creates a file in the Startup directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
create_lnk_2105720784.ps1
memory/4456-24-0x00007FF65D410000-0x00007FF65DB2E000-memory.dmp
memory/4456-18-0x00007FF65D410000-0x00007FF65DB2E000-memory.dmp
memory/4456-30-0x00007FF65D410000-0x00007FF65DB2E000-memory.dmp
memory/4456-29-0x00007FF65D410000-0x00007FF65DB2E000-memory.dmp
memory/4456-28-0x00007FF65D410000-0x00007FF65DB2E000-memory.dmp
memory/4456-27-0x00007FF65D410000-0x00007FF65DB2E000-memory.dmp
memory/4456-17-0x00007FF65D410000-0x00007FF65DB2E000-memory.dmp
memory/4456-26-0x00007FF65D410000-0x00007FF65DB2E000-memory.dmp
memory/4456-25-0x00007FF65D410000-0x00007FF65DB2E000-memory.dmp
memory/4456-16-0x00007FF65D410000-0x00007FF65DB2E000-memory.dmp
memory/4456-21-0x00007FF65D410000-0x00007FF65DB2E000-memory.dmp
memory/4456-20-0x00007FF65D410000-0x00007FF65DB2E000-memory.dmp
memory/4456-23-0x00007FF65D410000-0x00007FF65DB2E000-memory.dmp
memory/4456-19-0x00007FF65D410000-0x00007FF65DB2E000-memory.dmp
memory/5612-10-0x00007FFBACE90000-0x00007FFBAD834000-memory.dmp
memory/5612-5-0x00007FFBACE90000-0x00007FFBAD834000-memory.dmp
memory/5612-15-0x00007FFBACE90000-0x00007FFBAD834000-memory.dmp
memory/5612-1-0x00007FFBAD01F000-0x00007FFBAD020000-memory.dmp
memory/5612-14-0x00007FFBACE90000-0x00007FFBAD834000-memory.dmp
memory/5612-11-0x00007FFBACE90000-0x00007FFBAD834000-memory.dmp
memory/5612-9-0x00007FFBACE90000-0x00007FFBAD834000-memory.dmp
memory/5612-8-0x00007FFBACE90000-0x00007FFBAD834000-memory.dmp
memory/5612-4-0x0000020DEE4C0000-0x0000020DEE4E2000-memory.dmp
memory/5612-7-0x00007FFBACE90000-0x00007FFBAD834000-memory.dmp