Overview

overview

7

Static

static

3

2026-08-19...ch.exe

windows10-2004-x64

7

2026-08-19...ch.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    43s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/08/2026, 01:29

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-19_b6dd32421f8482f954085e60f42ce071_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  • Size 6.8MB
  • Sample260820-bwcszazycs
  • SHA256 2eafcd1e7f5a1b8c302da182fc06cd328232539471cd0dbf775866516dc93b1a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 1 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Looks up external IP address via web service 1 TTPs 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Hide Artifacts: Hidden Files and Directories 1 TTPs 2 IoCs
    defense_evasion
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Using powershell.exe command.

    execution
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • Checks processor information in registry 2 TTPs 17 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 5 IoCs
  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 2 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-19_b6dd32421f8482f954085e60f42ce071_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-19_b6dd32421f8482f954085e60f42ce071_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
    1⤵
    • Adds Run key to start application
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4264
    • C:\Windows\system32\cmd.exe
      cmd /c attrib +h +s +i C:\Users\Admin\AppData\Roaming\BossFix\BossFixAgent.exe
      2⤵
      • Hide Artifacts: Hidden Files and Directories
      • Suspicious use of WriteProcessMemory
      PID:4280
      • C:\Windows\system32\attrib.exe
        attrib +h +s +i C:\Users\Admin\AppData\Roaming\BossFix\BossFixAgent.exe
        3⤵
        • Views/modifies file attributes
        PID:5364
    • C:\Windows\system32\schtasks.exe
      schtasks /Create /F /TN BossFixAgentUpdate /TR \"C:\Users\Admin\AppData\Roaming\BossFix\BossFixAgent.exe\" /SC ONLOGON /RL LIMITED
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:4168
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ws = New-Object -ComObject WScript.Shell; $s = $ws.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BossFixAgent.exe.lnk'); $s.TargetPath = 'C:\Users\Admin\AppData\Roaming\BossFix\BossFixAgent.exe'; $s.WorkingDirectory = 'C:\Users\Admin\AppData\Roaming\BossFix'; $s.Save()"
      2⤵
      • Creates a file in the Startup directory
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2464
    • C:\Windows\system32\cmd.exe
      cmd /c attrib +h +s +i C:\Users\Admin\AppData\Roaming\BossFix
      2⤵
      • Hide Artifacts: Hidden Files and Directories
      • Suspicious use of WriteProcessMemory
      PID:4312
      • C:\Windows\system32\attrib.exe
        attrib +h +s +i C:\Users\Admin\AppData\Roaming\BossFix
        3⤵
        • Views/modifies file attributes
        PID:4924
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $g = Get-CimInstance Win32_VideoController | Select-Object Name,DriverVersion,AdapterRAM,AdapterCompatibility $d = Get-CimInstance Win32_DiskDrive | Select-Object Model,SerialNumber,Size,MediaType $v = Get-CimInstance Win32_LogicalDisk | Select-Object DriveLetter,VolumeName,Size,SizeRemaining,FileSystem $b = Get-CimInstance Win32_BaseBoard | Select-Object Product,Manufacturer,SerialNumber $s = Get-CimInstance Win32_BIOS | Select-Object Manufacturer,SMBIOSBIOSVersion,ReleaseDate $m = [System.Windows.Forms.Screen]::AllScreens | ForEach-Object { $_.DeviceName + ' ' + $_.Bounds.Width + 'x' + $_.Bounds.Height } Add-Type -AssemblyName System.Windows.Forms [pscustomobject]@{gp=$g;dk=$d;vl=$v;bd=$b;bs=$s;mo=$m} | ConvertTo-Json -Compress -Depth 4 "
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3952
    • C:\Windows\system32\cmd.exe
      cmd /c "netsh wlan show profiles"
      2⤵
      • Executes a command shell one-liner
      • System Network Configuration Discovery: Wi-Fi Discovery
      • Suspicious use of WriteProcessMemory
      PID:4848
      • C:\Windows\system32\netsh.exe
        netsh wlan show profiles
        3⤵
        • Event Triggered Execution: Netsh Helper DLL
        • System Network Configuration Discovery: Wi-Fi Discovery
        PID:5272
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_NetworkAdapterConfiguration | Where-Object {$_.IPAddress} | Select-Object Description,IPAddress,IPSubnet,MACAddress,DNSHostName | ConvertTo-Json -Compress -Depth 3"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      PID:6028
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "ipconfig /all"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1988
      • C:\Windows\system32\ipconfig.exe
        "C:\Windows\system32\ipconfig.exe" /all
        3⤵
        • Gathers network information
        PID:2240
  • C:\Users\Admin\AppData\Roaming\BossFix\BossFixAgent.exe
    "C:\Users\Admin\AppData\Roaming\BossFix\BossFixAgent.exe"
    1⤵
    • Executes dropped EXE
    • Enumerates system info in registry
    PID:2084

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Command and Scripting Interpreter

        3
        T1059

        PowerShell

        1
        T1059.001

        Windows Command Shell

        1
        T1059.003

        Scheduled Task/Job

        1
        T1053

        Scheduled Task

        1
        T1053.005

        Persistence

        Boot or Logon Autostart Execution

        2
        T1547

        Registry Run Keys / Startup Folder

        2
        T1547.001

        Event Triggered Execution

        1
        T1546

        Netsh Helper DLL

        1
        T1546.007

        Scheduled Task/Job

        1
        T1053

        Scheduled Task

        1
        T1053.005

        Privilege Escalation

        Boot or Logon Autostart Execution

        2
        T1547

        Registry Run Keys / Startup Folder

        2
        T1547.001

        Event Triggered Execution

        1
        T1546

        Netsh Helper DLL

        1
        T1546.007

        Scheduled Task/Job

        1
        T1053

        Scheduled Task

        1
        T1053.005

        Defense Evasion

        Hide Artifacts

        2
        T1564

        Hidden Files and Directories

        2
        T1564.001

        Modify Registry

        1
        T1112

        Credential Access

        Credentials from Password Stores

        1
        T1555

        Credentials from Web Browsers

        1
        T1555.003

        Unsecured Credentials

        1
        T1552

        Credentials In Files

        1
        T1552.001

        Discovery

        Browser Information Discovery

        1
        T1217

        Query Registry

        4
        T1012

        System Information Discovery

        3
        T1082

        System Network Configuration Discovery

        2
        T1016

        Internet Connection Discovery

        1
        T1016.001

        Wi-Fi Discovery

        1
        T1016.002

        Lateral Movement

        Collection

        Data from Local System

        1
        T1005

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 b67191a152d4566d0194395342f55c6142d94005610603fdc92ac4d491519f82
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 aaa4752048235b5a738d1c34e29ac2c8ff819cc657e4d6664fc9cc115ce42bf0
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 74c099c6b9856eed20374f1ca04018abf666f405cadd05a552c4920f486eb830
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        __PSScriptPolicyTest_ajdevu4o.t3h.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ajdevu4o.t3h.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        BossFixAgent.exe
        • Path C:\Users\Admin\AppData\Roaming\BossFix\BossFixAgent.exe
        • Size 6.8MB
        • SHA256 2eafcd1e7f5a1b8c302da182fc06cd328232539471cd0dbf775866516dc93b1a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1988-46-0x000002399B6D0000-0x000002399B7FF000-memory.dmp
        Download

        memory/2464-11-0x00007FFF431D0000-0x00007FFF43B74000-memory.dmp
        Download

        memory/2464-6-0x00007FFF431D0000-0x00007FFF43B74000-memory.dmp
        Download

        memory/2464-12-0x00007FFF431D0000-0x00007FFF43B74000-memory.dmp
        Download

        memory/2464-13-0x00007FFF431D0000-0x00007FFF43B74000-memory.dmp
        Download

        memory/2464-14-0x00007FFF431D0000-0x00007FFF43B74000-memory.dmp
        Download

        memory/2464-16-0x00007FFF431D0000-0x00007FFF43B74000-memory.dmp
        Download

        memory/2464-19-0x00007FFF431D0000-0x00007FFF43B74000-memory.dmp
        Download

        memory/2464-18-0x000001E75F310000-0x000001E75F43F000-memory.dmp
        Download

        memory/2464-9-0x00007FFF431D0000-0x00007FFF43B74000-memory.dmp
        Download

        memory/2464-49-0x00007FFF431D0000-0x00007FFF43B74000-memory.dmp
        Download

        memory/2464-3-0x00007FFF4335F000-0x00007FFF43360000-memory.dmp
        Download

        memory/2464-10-0x00007FFF431D0000-0x00007FFF43B74000-memory.dmp
        Download

        memory/2464-4-0x00007FFF431D0000-0x00007FFF43B74000-memory.dmp
        Download

        memory/2464-5-0x000001E746C60000-0x000001E746C82000-memory.dmp
        Download

        memory/3952-29-0x000001D7A90F0000-0x000001D7A911A000-memory.dmp
        Download

        memory/3952-31-0x000001D7A92C0000-0x000001D7A9482000-memory.dmp
        Download

        memory/3952-32-0x000001D7A99C0000-0x000001D7A9EE8000-memory.dmp
        Download

        memory/3952-34-0x000001D7A8B40000-0x000001D7A8C6F000-memory.dmp
        Download

        memory/3952-30-0x000001D7A90F0000-0x000001D7A9114000-memory.dmp
        Download

        memory/3952-28-0x000001D790480000-0x000001D79048A000-memory.dmp
        Download

        memory/3952-27-0x000001D7A8A50000-0x000001D7A8B02000-memory.dmp
        Download

        memory/3952-26-0x000001D7A8A30000-0x000001D7A8A4E000-memory.dmp
        Download

        memory/6028-41-0x00000257B8CB0000-0x00000257B8DDF000-memory.dmp
        Download