Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/08/2026, 01:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-19_6d2c9fcc572e279536f28314fc724e40_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-19_6d2c9fcc572e279536f28314fc724e40_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target 2026-08-19_6d2c9fcc572e279536f28314fc724e40_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
- Size 20.9MB
- Sample260820-b4waaadk21
- SHA256 a630fc478963f97d999a6b2f290c456a55a4ba377ce55ed661c7c17a55250366
- MD5 6d2c9fcc572e279536f28314fc724e40
- SHA1 8b565a099de7992de67d9af3519ae09bb3ba5f87
- SHA512 bc015584d98c31d1ab9f8a202cbe8cd7ad5e00c94c4ce9b59440eaf82655b1d04c37e100d913c8d49be09dddd31c17830227a78f3bf1cda2280e58a6c83faaee
- SSDEEP 196608:CJkrP1O6s4lrR1xTaUVdBdldkadpkm1WT:C74RTTNBSM8
- TLSH T173272963E8D22AD4C4EE85B4C6B2413BBA617C491B3863E70690F3605F37BD09EB2755
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Discovers running processes 1 TTPs 1 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 5416 tasklist.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5416 tasklist.exe Token: SeDebugPrivilege 3852 whoami.exe Token: SeDebugPrivilege 3852 whoami.exe Token: SeDebugPrivilege 3852 whoami.exe Token: SeDebugPrivilege 3852 whoami.exe Token: SeDebugPrivilege 3852 whoami.exe Token: SeDebugPrivilege 3852 whoami.exe Token: SeDebugPrivilege 3852 whoami.exe Token: SeDebugPrivilege 3852 whoami.exe Token: SeDebugPrivilege 3852 whoami.exe Token: SeDebugPrivilege 3852 whoami.exe Token: SeDebugPrivilege 3852 whoami.exe Token: SeDebugPrivilege 3852 whoami.exe Token: SeDebugPrivilege 3852 whoami.exe Token: SeDebugPrivilege 3852 whoami.exe Token: SeDebugPrivilege 3852 whoami.exe Token: SeDebugPrivilege 3852 whoami.exe Token: SeDebugPrivilege 3852 whoami.exe Token: SeDebugPrivilege 3852 whoami.exe Token: SeDebugPrivilege 3852 whoami.exe Token: SeDebugPrivilege 3852 whoami.exe Token: SeDebugPrivilege 3852 whoami.exe Token: SeDebugPrivilege 3852 whoami.exe Token: SeDebugPrivilege 3852 whoami.exe Token: SeDebugPrivilege 3852 whoami.exe Token: SeDebugPrivilege 3852 whoami.exe Token: SeDebugPrivilege 3852 whoami.exe Token: SeDebugPrivilege 2776 whoami.exe Token: SeDebugPrivilege 2776 whoami.exe Token: SeDebugPrivilege 2776 whoami.exe Token: SeDebugPrivilege 2776 whoami.exe Token: SeDebugPrivilege 2776 whoami.exe Token: SeDebugPrivilege 2776 whoami.exe Token: SeDebugPrivilege 2776 whoami.exe Token: SeDebugPrivilege 2776 whoami.exe Token: SeDebugPrivilege 2776 whoami.exe Token: SeDebugPrivilege 2776 whoami.exe Token: SeDebugPrivilege 2776 whoami.exe Token: SeDebugPrivilege 2776 whoami.exe Token: SeDebugPrivilege 2776 whoami.exe Token: SeDebugPrivilege 2776 whoami.exe Token: SeDebugPrivilege 2776 whoami.exe Token: SeDebugPrivilege 2776 whoami.exe Token: SeDebugPrivilege 2776 whoami.exe Token: SeDebugPrivilege 2776 whoami.exe Token: SeDebugPrivilege 2776 whoami.exe Token: SeDebugPrivilege 2776 whoami.exe Token: SeDebugPrivilege 2776 whoami.exe Token: SeDebugPrivilege 2776 whoami.exe Token: SeDebugPrivilege 2776 whoami.exe Token: SeDebugPrivilege 2776 whoami.exe Token: SeDebugPrivilege 2776 whoami.exe Token: SeDebugPrivilege 2776 whoami.exe Token: SeDebugPrivilege 3800 whoami.exe Token: SeDebugPrivilege 3800 whoami.exe Token: SeDebugPrivilege 3800 whoami.exe Token: SeDebugPrivilege 3800 whoami.exe Token: SeDebugPrivilege 3800 whoami.exe Token: SeDebugPrivilege 3800 whoami.exe Token: SeDebugPrivilege 3800 whoami.exe Token: SeDebugPrivilege 3800 whoami.exe Token: SeDebugPrivilege 3800 whoami.exe Token: SeDebugPrivilege 3800 whoami.exe Token: SeDebugPrivilege 3800 whoami.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1492 wrote to memory of 5416 1492 2026-08-19_6d2c9fcc572e279536f28314fc724e40_coinminer_dosia_poet-rat_quasar-rat_snatch.exe 90 PID 1492 wrote to memory of 3852 1492 2026-08-19_6d2c9fcc572e279536f28314fc724e40_coinminer_dosia_poet-rat_quasar-rat_snatch.exe 92 PID 1492 wrote to memory of 2776 1492 2026-08-19_6d2c9fcc572e279536f28314fc724e40_coinminer_dosia_poet-rat_quasar-rat_snatch.exe 93 PID 1492 wrote to memory of 3800 1492 2026-08-19_6d2c9fcc572e279536f28314fc724e40_coinminer_dosia_poet-rat_quasar-rat_snatch.exe 95 PID 1492 wrote to memory of 4396 1492 2026-08-19_6d2c9fcc572e279536f28314fc724e40_coinminer_dosia_poet-rat_quasar-rat_snatch.exe 96 PID 1492 wrote to memory of 2880 1492 2026-08-19_6d2c9fcc572e279536f28314fc724e40_coinminer_dosia_poet-rat_quasar-rat_snatch.exe 97 PID 1492 wrote to memory of 2780 1492 2026-08-19_6d2c9fcc572e279536f28314fc724e40_coinminer_dosia_poet-rat_quasar-rat_snatch.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-19_6d2c9fcc572e279536f28314fc724e40_coinminer_dosia_poet-rat_quasar-rat_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-19_6d2c9fcc572e279536f28314fc724e40_coinminer_dosia_poet-rat_quasar-rat_snatch.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Windows\system32\tasklist.exetasklist /fo csv /nh2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
PID:5416
-
-
C:\Windows\system32\whoami.exewhoami /groups2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3852
-
-
C:\Windows\system32\whoami.exewhoami /groups2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2776
-
-
C:\Windows\system32\whoami.exewhoami /groups2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3800
-
-
C:\Windows\system32\whoami.exewhoami /groups2⤵PID:4396
-
-
C:\Windows\system32\whoami.exewhoami /groups2⤵PID:2880
-
-
C:\Windows\system32\whoami.exewhoami /groups2⤵PID:2780
-