Analysis
- max time kernel
150s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/08/2026, 03:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-17_6b121416ee1db0b8b55c9bb46c6468b3_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-17_6b121416ee1db0b8b55c9bb46c6468b3_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target 2026-08-17_6b121416ee1db0b8b55c9bb46c6468b3_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
- Size 21.1MB
- Sample260818-ds37vsdm2y
- SHA256 933958366c489cf4738691b568369dfc461b05c804d40f32b7d69f92d95fda60
- MD5 6b121416ee1db0b8b55c9bb46c6468b3
- SHA1 02fdbb765aa1b37e998885593c02f4f76369e1dd
- SHA512 34e86fe0dd96b4ccfc88717a5abd24c845c44896840de02cc31541fa96e58e08369fa45c9cbd2c148daddc3bf1978d100648071c5f038735ed316a9a3a5e38c2
- SSDEEP 196608:I225JIxGXKLA75t9jeLeV4MKsNg2NLv4M5s/Is3:ICxGXKLA75tpeaVB3+Gs/t
- TLSH T1B6274B27E8D255D4C4EEC1B0C6B2827BBA653C491B7863D70290B3215F337E09EB6796
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Discovers running processes 1 TTPs 1 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 3628 tasklist.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3628 tasklist.exe Token: SeDebugPrivilege 5212 whoami.exe Token: SeDebugPrivilege 5212 whoami.exe Token: SeDebugPrivilege 5212 whoami.exe Token: SeDebugPrivilege 5212 whoami.exe Token: SeDebugPrivilege 5212 whoami.exe Token: SeDebugPrivilege 5212 whoami.exe Token: SeDebugPrivilege 5212 whoami.exe Token: SeDebugPrivilege 5212 whoami.exe Token: SeDebugPrivilege 5212 whoami.exe Token: SeDebugPrivilege 5212 whoami.exe Token: SeDebugPrivilege 5212 whoami.exe Token: SeDebugPrivilege 5212 whoami.exe Token: SeDebugPrivilege 5212 whoami.exe Token: SeDebugPrivilege 5212 whoami.exe Token: SeDebugPrivilege 5212 whoami.exe Token: SeDebugPrivilege 5212 whoami.exe Token: SeDebugPrivilege 5212 whoami.exe Token: SeDebugPrivilege 5212 whoami.exe Token: SeDebugPrivilege 5212 whoami.exe Token: SeDebugPrivilege 5212 whoami.exe Token: SeDebugPrivilege 5212 whoami.exe Token: SeDebugPrivilege 5212 whoami.exe Token: SeDebugPrivilege 5212 whoami.exe Token: SeDebugPrivilege 5212 whoami.exe Token: SeDebugPrivilege 5212 whoami.exe Token: SeDebugPrivilege 5212 whoami.exe Token: SeDebugPrivilege 1692 whoami.exe Token: SeDebugPrivilege 1692 whoami.exe Token: SeDebugPrivilege 1692 whoami.exe Token: SeDebugPrivilege 1692 whoami.exe Token: SeDebugPrivilege 1692 whoami.exe Token: SeDebugPrivilege 1692 whoami.exe Token: SeDebugPrivilege 1692 whoami.exe Token: SeDebugPrivilege 1692 whoami.exe Token: SeDebugPrivilege 1692 whoami.exe Token: SeDebugPrivilege 1692 whoami.exe Token: SeDebugPrivilege 1692 whoami.exe Token: SeDebugPrivilege 1692 whoami.exe Token: SeDebugPrivilege 1692 whoami.exe Token: SeDebugPrivilege 1692 whoami.exe Token: SeDebugPrivilege 1692 whoami.exe Token: SeDebugPrivilege 1692 whoami.exe Token: SeDebugPrivilege 1692 whoami.exe Token: SeDebugPrivilege 1692 whoami.exe Token: SeDebugPrivilege 1692 whoami.exe Token: SeDebugPrivilege 1692 whoami.exe Token: SeDebugPrivilege 1692 whoami.exe Token: SeDebugPrivilege 1692 whoami.exe Token: SeDebugPrivilege 1692 whoami.exe Token: SeDebugPrivilege 1692 whoami.exe Token: SeDebugPrivilege 1692 whoami.exe Token: SeDebugPrivilege 1692 whoami.exe Token: SeDebugPrivilege 3920 whoami.exe Token: SeDebugPrivilege 3920 whoami.exe Token: SeDebugPrivilege 3920 whoami.exe Token: SeDebugPrivilege 3920 whoami.exe Token: SeDebugPrivilege 3920 whoami.exe Token: SeDebugPrivilege 3920 whoami.exe Token: SeDebugPrivilege 3920 whoami.exe Token: SeDebugPrivilege 3920 whoami.exe Token: SeDebugPrivilege 3920 whoami.exe Token: SeDebugPrivilege 3920 whoami.exe Token: SeDebugPrivilege 3920 whoami.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3748 wrote to memory of 3628 3748 2026-08-17_6b121416ee1db0b8b55c9bb46c6468b3_coinminer_dosia_poet-rat_quasar-rat_snatch.exe 89 PID 3748 wrote to memory of 5212 3748 2026-08-17_6b121416ee1db0b8b55c9bb46c6468b3_coinminer_dosia_poet-rat_quasar-rat_snatch.exe 92 PID 3748 wrote to memory of 1692 3748 2026-08-17_6b121416ee1db0b8b55c9bb46c6468b3_coinminer_dosia_poet-rat_quasar-rat_snatch.exe 94 PID 3748 wrote to memory of 3920 3748 2026-08-17_6b121416ee1db0b8b55c9bb46c6468b3_coinminer_dosia_poet-rat_quasar-rat_snatch.exe 97 PID 3748 wrote to memory of 3676 3748 2026-08-17_6b121416ee1db0b8b55c9bb46c6468b3_coinminer_dosia_poet-rat_quasar-rat_snatch.exe 99 PID 3748 wrote to memory of 5396 3748 2026-08-17_6b121416ee1db0b8b55c9bb46c6468b3_coinminer_dosia_poet-rat_quasar-rat_snatch.exe 101 PID 3748 wrote to memory of 5512 3748 2026-08-17_6b121416ee1db0b8b55c9bb46c6468b3_coinminer_dosia_poet-rat_quasar-rat_snatch.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-17_6b121416ee1db0b8b55c9bb46c6468b3_coinminer_dosia_poet-rat_quasar-rat_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-17_6b121416ee1db0b8b55c9bb46c6468b3_coinminer_dosia_poet-rat_quasar-rat_snatch.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Windows\system32\tasklist.exetasklist /fo csv /nh2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
PID:3628
-
-
C:\Windows\system32\whoami.exewhoami /groups2⤵
- Suspicious use of AdjustPrivilegeToken
PID:5212
-
-
C:\Windows\system32\whoami.exewhoami /groups2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1692
-
-
C:\Windows\system32\whoami.exewhoami /groups2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3920
-
-
C:\Windows\system32\whoami.exewhoami /groups2⤵PID:3676
-
-
C:\Windows\system32\whoami.exewhoami /groups2⤵PID:5396
-
-
C:\Windows\system32\whoami.exewhoami /groups2⤵PID:5512
-