af1520326c6a2dae3ddfc1b60daf0bdb6622b44b5ac02be4510b4b2e49f6d35d

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/08/2026, 19:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_415bfaf129271b2a52139700f207146f_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe
Size 13.2MB
Sample260820-xt5a4ahn6w
SHA256 af1520326c6a2dae3ddfc1b60daf0bdb6622b44b5ac02be4510b4b2e49f6d35d
MD5 415bfaf129271b2a52139700f207146f
SHA1 0f2fcaf2352577c856d5cb3f5c401d29d1cdc121
SHA512 c593b570ba21c527424b098006c8eb84758073be40e56b2eae7eb73b91c9290dd733b7f9e343cd8df3f7e3c9bd0986c75d93a4dbdd4ee6ba76ba88847029eb10
SSDEEP 98304:X4YczIuDCw6q61QJlwMjtv8Wu/jfkO2GHTBKnEcD:XW0pcN1u/j9YEcD
TLSH
T1EFD64A57F8A54AD8C4ADD53089769523BB717C494B3023D71B60F6283F3ABE0AEB9740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion execution persistence privilege_escalation

Malware Config

Signatures

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
behavioral1/files/0x0009000000024695-39.dat	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral1/files/0x0009000000024695-39.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral1/files/0x0009000000024695-39.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4708	powershell.exe
4408	powershell.exe
5520	powershell.exe
5520	powershell.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecurityHealthHost.cmd	2026-08-20_415bfaf129271b2a52139700f207146f_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe

Executes dropped EXE 1 IoCs

pid	Process
2508	SecurityHealthHost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\DeviceSync\\SecurityHealthHost.exe"	reg.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
3124	reg.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4708	powershell.exe
4708	powershell.exe
4408	powershell.exe
4408	powershell.exe
5520	powershell.exe
5520	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4708	powershell.exe
Token: SeDebugPrivilege	4408	powershell.exe
Token: SeIncreaseQuotaPrivilege	4408	powershell.exe
Token: SeSecurityPrivilege	4408	powershell.exe
Token: SeTakeOwnershipPrivilege	4408	powershell.exe
Token: SeLoadDriverPrivilege	4408	powershell.exe
Token: SeSystemProfilePrivilege	4408	powershell.exe
Token: SeSystemtimePrivilege	4408	powershell.exe
Token: SeProfSingleProcessPrivilege	4408	powershell.exe
Token: SeIncBasePriorityPrivilege	4408	powershell.exe
Token: SeCreatePagefilePrivilege	4408	powershell.exe
Token: SeBackupPrivilege	4408	powershell.exe
Token: SeRestorePrivilege	4408	powershell.exe
Token: SeShutdownPrivilege	4408	powershell.exe
Token: SeDebugPrivilege	4408	powershell.exe
Token: SeSystemEnvironmentPrivilege	4408	powershell.exe
Token: SeRemoteShutdownPrivilege	4408	powershell.exe
Token: SeUndockPrivilege	4408	powershell.exe
Token: SeManageVolumePrivilege	4408	powershell.exe
Token: 33	4408	powershell.exe
Token: 34	4408	powershell.exe
Token: 35	4408	powershell.exe
Token: 36	4408	powershell.exe
Token: SeIncreaseQuotaPrivilege	4408	powershell.exe
Token: SeSecurityPrivilege	4408	powershell.exe
Token: SeTakeOwnershipPrivilege	4408	powershell.exe
Token: SeLoadDriverPrivilege	4408	powershell.exe
Token: SeSystemProfilePrivilege	4408	powershell.exe
Token: SeSystemtimePrivilege	4408	powershell.exe
Token: SeProfSingleProcessPrivilege	4408	powershell.exe
Token: SeIncBasePriorityPrivilege	4408	powershell.exe
Token: SeCreatePagefilePrivilege	4408	powershell.exe
Token: SeBackupPrivilege	4408	powershell.exe
Token: SeRestorePrivilege	4408	powershell.exe
Token: SeShutdownPrivilege	4408	powershell.exe
Token: SeDebugPrivilege	4408	powershell.exe
Token: SeSystemEnvironmentPrivilege	4408	powershell.exe
Token: SeRemoteShutdownPrivilege	4408	powershell.exe
Token: SeUndockPrivilege	4408	powershell.exe
Token: SeManageVolumePrivilege	4408	powershell.exe
Token: 33	4408	powershell.exe
Token: 34	4408	powershell.exe
Token: 35	4408	powershell.exe
Token: 36	4408	powershell.exe
Token: SeIncreaseQuotaPrivilege	4408	powershell.exe
Token: SeSecurityPrivilege	4408	powershell.exe
Token: SeTakeOwnershipPrivilege	4408	powershell.exe
Token: SeLoadDriverPrivilege	4408	powershell.exe
Token: SeSystemProfilePrivilege	4408	powershell.exe
Token: SeSystemtimePrivilege	4408	powershell.exe
Token: SeProfSingleProcessPrivilege	4408	powershell.exe
Token: SeIncBasePriorityPrivilege	4408	powershell.exe
Token: SeCreatePagefilePrivilege	4408	powershell.exe
Token: SeBackupPrivilege	4408	powershell.exe
Token: SeRestorePrivilege	4408	powershell.exe
Token: SeShutdownPrivilege	4408	powershell.exe
Token: SeDebugPrivilege	4408	powershell.exe
Token: SeSystemEnvironmentPrivilege	4408	powershell.exe
Token: SeRemoteShutdownPrivilege	4408	powershell.exe
Token: SeUndockPrivilege	4408	powershell.exe
Token: SeManageVolumePrivilege	4408	powershell.exe
Token: 33	4408	powershell.exe
Token: 34	4408	powershell.exe
Token: 35	4408	powershell.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4836 wrote to memory of 4720	4836	2026-08-20_415bfaf129271b2a52139700f207146f_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	86
PID 4836 wrote to memory of 4708	4836	2026-08-20_415bfaf129271b2a52139700f207146f_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	88
PID 4836 wrote to memory of 4408	4836	2026-08-20_415bfaf129271b2a52139700f207146f_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	90
PID 4836 wrote to memory of 3124	4836	2026-08-20_415bfaf129271b2a52139700f207146f_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	93
PID 4836 wrote to memory of 5520	4836	2026-08-20_415bfaf129271b2a52139700f207146f_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	95

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4720	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-20_415bfaf129271b2a52139700f207146f_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_415bfaf129271b2a52139700f207146f_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe"
1⤵
- Creates a file in the Startup directory
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Windows\system32\attrib.exe
  attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync
  2⤵
  - Views/modifies file attributes
  PID:4720
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance(); $f.QueryLanguage = 'WQL'; $f.Query = \"SELECT * FROM __InstanceCreationEvent WITHIN 30 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name = 'explorer.exe'\"; $f.Name = 'SecurityHealthHost_f_23e52075'; $f.EventNameSpace = 'root\cimv2'; $null = $f.Put(); $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance(); $c.Name = 'SecurityHealthHost_c_23e52075'; $c.ExecutablePath = 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\SecurityHealthHost.exe'; $null = $c.Put(); $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance(); $b.Filter = \"\\.\root\subscription:__EventFilter.Name='SecurityHealthHost_f_23e52075'\"; $b.Consumer = \"\\.\root\subscription:CommandLineEventConsumer.Name='SecurityHealthHost_c_23e52075'\"; $null = $b.Put()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4708
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\SecurityHealthHost.exe'; $t = New-ScheduledTaskTrigger -AtLogOn; $s = New-ScheduledTaskSettingsSet -ExecutionTimeLimit ([TimeSpan]::Zero) -StartWhenAvailable; $p = New-ScheduledTaskPrincipal -UserId $env:USERNAME -RunLevel Highest; Register-ScheduledTask -TaskName 'SecurityHealthHost_23e52075' -Action $a -Trigger $t -Settings $s -Principal $p -Force | Out-Null"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4408
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SecurityHealthHost /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\SecurityHealthHost.exe /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:3124
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "Try { Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync'; Add-MpPreference -ExclusionProcess 'SecurityHealthHost.exe' } Catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5520

C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\SecurityHealthHost.exe
C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\SecurityHealthHost.exe
1⤵
- Executes dropped EXE
PID:2508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 87470f23f1ebc2e1083f6f925feea4165d6885913e16b98bcd9ec9575934aeb0
MD5 8ec17e59a48ff67c5fb0831ec339fcdc
SHA1 d40683f3deb31c5f1df36e50fe32c19cc3b1c19d
SHA512 ca53253722c9383b8e03a4a1a8db9151e7cb092b09fda68a8a1b3a45c31a325a69c4d85ebb4ccdfe13e4d9c91969c17b5d8b84b0dab7dcc1d2774967cca00515
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 95978f0cd185a63a1f101279a7dab24a31aa1f79c50a93a0e5ec2ef78f56b7c1
MD5 eabdd04bf5edeab42ad20528f9745933
SHA1 ff047df122051917fb7d25d0f5a76788f4b5ca7c
SHA512 e8784866ffee75e66283c3e47f57a8522e6e616f19cbfb692721525e72e574a5b60d9d125c41210f1e57d30e60be05b3d7fdbcf34ce7d31948e60078bc76c350
TLSH
T118217827B3DC8860CCDA1636108D9C5532A692CB81DECFDB2AC0C21195BF6C8CB61250
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_lzbaro0p.0ee.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lzbaro0p.0ee.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

SecurityHealthHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\SecurityHealthHost.exe
Size 13.2MB
SHA256 af1520326c6a2dae3ddfc1b60daf0bdb6622b44b5ac02be4510b4b2e49f6d35d
MD5 415bfaf129271b2a52139700f207146f
SHA1 0f2fcaf2352577c856d5cb3f5c401d29d1cdc121
SHA512 c593b570ba21c527424b098006c8eb84758073be40e56b2eae7eb73b91c9290dd733b7f9e343cd8df3f7e3c9bd0986c75d93a4dbdd4ee6ba76ba88847029eb10
SSDEEP 98304:X4YczIuDCw6q61QJlwMjtv8Wu/jfkO2GHTBKnEcD:XW0pcN1u/j9YEcD
TLSH
T1EFD64A57F8A54AD8C4ADD53089769523BB717C494B3023D71B60F6283F3ABE0AEB9740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4708-4-0x000002CFFEB60000-0x000002CFFEB70000-memory.dmp

Download

memory/4708-3-0x000002CFFEB60000-0x000002CFFEB70000-memory.dmp

Download

memory/4708-5-0x000002CFE63A0000-0x000002CFE63C2000-memory.dmp

Download

memory/4708-15-0x000002CF82280000-0x000002CF8249C000-memory.dmp

Download

memory/5520-36-0x000002A479D90000-0x000002A479FAC000-memory.dmp

Download