Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
20/08/2026, 01:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-19_6d2c9fcc572e279536f28314fc724e40_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-19_6d2c9fcc572e279536f28314fc724e40_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target 2026-08-19_6d2c9fcc572e279536f28314fc724e40_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
- Size 20.9MB
- Sample260820-b4waaadk21
- SHA256 a630fc478963f97d999a6b2f290c456a55a4ba377ce55ed661c7c17a55250366
- MD5 6d2c9fcc572e279536f28314fc724e40
- SHA1 8b565a099de7992de67d9af3519ae09bb3ba5f87
- SHA512 bc015584d98c31d1ab9f8a202cbe8cd7ad5e00c94c4ce9b59440eaf82655b1d04c37e100d913c8d49be09dddd31c17830227a78f3bf1cda2280e58a6c83faaee
- SSDEEP 196608:CJkrP1O6s4lrR1xTaUVdBdldkadpkm1WT:C74RTTNBSM8
- TLSH T173272963E8D22AD4C4EE85B4C6B2413BBA617C491B3863E70690F3605F37BD09EB2755
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Discovers running processes 1 TTPs 1 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 4332 tasklist.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4332 tasklist.exe Token: SeDebugPrivilege 3660 whoami.exe Token: SeDebugPrivilege 3660 whoami.exe Token: SeDebugPrivilege 3660 whoami.exe Token: SeDebugPrivilege 3660 whoami.exe Token: SeDebugPrivilege 3660 whoami.exe Token: SeDebugPrivilege 3660 whoami.exe Token: SeDebugPrivilege 3660 whoami.exe Token: SeDebugPrivilege 3660 whoami.exe Token: SeDebugPrivilege 3660 whoami.exe Token: SeDebugPrivilege 3660 whoami.exe Token: SeDebugPrivilege 3660 whoami.exe Token: SeDebugPrivilege 3660 whoami.exe Token: SeDebugPrivilege 3660 whoami.exe Token: SeDebugPrivilege 3660 whoami.exe Token: SeDebugPrivilege 3660 whoami.exe Token: SeDebugPrivilege 3660 whoami.exe Token: SeDebugPrivilege 3660 whoami.exe Token: SeDebugPrivilege 3660 whoami.exe Token: SeDebugPrivilege 3660 whoami.exe Token: SeDebugPrivilege 3660 whoami.exe Token: SeDebugPrivilege 3660 whoami.exe Token: SeDebugPrivilege 3660 whoami.exe Token: SeDebugPrivilege 3660 whoami.exe Token: SeDebugPrivilege 3660 whoami.exe Token: SeDebugPrivilege 3660 whoami.exe Token: SeDebugPrivilege 3660 whoami.exe Token: SeDebugPrivilege 3740 whoami.exe Token: SeDebugPrivilege 3740 whoami.exe Token: SeDebugPrivilege 3740 whoami.exe Token: SeDebugPrivilege 3740 whoami.exe Token: SeDebugPrivilege 3740 whoami.exe Token: SeDebugPrivilege 3740 whoami.exe Token: SeDebugPrivilege 3740 whoami.exe Token: SeDebugPrivilege 3740 whoami.exe Token: SeDebugPrivilege 3740 whoami.exe Token: SeDebugPrivilege 3740 whoami.exe Token: SeDebugPrivilege 3740 whoami.exe Token: SeDebugPrivilege 3740 whoami.exe Token: SeDebugPrivilege 3740 whoami.exe Token: SeDebugPrivilege 3740 whoami.exe Token: SeDebugPrivilege 3740 whoami.exe Token: SeDebugPrivilege 3740 whoami.exe Token: SeDebugPrivilege 3740 whoami.exe Token: SeDebugPrivilege 3740 whoami.exe Token: SeDebugPrivilege 3740 whoami.exe Token: SeDebugPrivilege 3740 whoami.exe Token: SeDebugPrivilege 3740 whoami.exe Token: SeDebugPrivilege 3740 whoami.exe Token: SeDebugPrivilege 3740 whoami.exe Token: SeDebugPrivilege 3740 whoami.exe Token: SeDebugPrivilege 3740 whoami.exe Token: SeDebugPrivilege 3740 whoami.exe Token: SeDebugPrivilege 1428 whoami.exe Token: SeDebugPrivilege 1428 whoami.exe Token: SeDebugPrivilege 1428 whoami.exe Token: SeDebugPrivilege 1428 whoami.exe Token: SeDebugPrivilege 1428 whoami.exe Token: SeDebugPrivilege 1428 whoami.exe Token: SeDebugPrivilege 1428 whoami.exe Token: SeDebugPrivilege 1428 whoami.exe Token: SeDebugPrivilege 1428 whoami.exe Token: SeDebugPrivilege 1428 whoami.exe Token: SeDebugPrivilege 1428 whoami.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3724 wrote to memory of 4332 3724 2026-08-19_6d2c9fcc572e279536f28314fc724e40_coinminer_dosia_poet-rat_quasar-rat_snatch.exe 85 PID 3724 wrote to memory of 3660 3724 2026-08-19_6d2c9fcc572e279536f28314fc724e40_coinminer_dosia_poet-rat_quasar-rat_snatch.exe 87 PID 3724 wrote to memory of 3740 3724 2026-08-19_6d2c9fcc572e279536f28314fc724e40_coinminer_dosia_poet-rat_quasar-rat_snatch.exe 90 PID 3724 wrote to memory of 1428 3724 2026-08-19_6d2c9fcc572e279536f28314fc724e40_coinminer_dosia_poet-rat_quasar-rat_snatch.exe 93 PID 3724 wrote to memory of 3348 3724 2026-08-19_6d2c9fcc572e279536f28314fc724e40_coinminer_dosia_poet-rat_quasar-rat_snatch.exe 101 PID 3724 wrote to memory of 4928 3724 2026-08-19_6d2c9fcc572e279536f28314fc724e40_coinminer_dosia_poet-rat_quasar-rat_snatch.exe 102 PID 3724 wrote to memory of 3696 3724 2026-08-19_6d2c9fcc572e279536f28314fc724e40_coinminer_dosia_poet-rat_quasar-rat_snatch.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-19_6d2c9fcc572e279536f28314fc724e40_coinminer_dosia_poet-rat_quasar-rat_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-19_6d2c9fcc572e279536f28314fc724e40_coinminer_dosia_poet-rat_quasar-rat_snatch.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Windows\system32\tasklist.exetasklist /fo csv /nh2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
PID:4332
-
-
C:\Windows\system32\whoami.exewhoami /groups2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3660
-
-
C:\Windows\system32\whoami.exewhoami /groups2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3740
-
-
C:\Windows\system32\whoami.exewhoami /groups2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1428
-
-
C:\Windows\system32\whoami.exewhoami /groups2⤵PID:3348
-
-
C:\Windows\system32\whoami.exewhoami /groups2⤵PID:4928
-
-
C:\Windows\system32\whoami.exewhoami /groups2⤵PID:3696
-