Analysis
- max time kernel
150s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/08/2026, 20:02
Behavioral task
behavioral1
Sample
2026-08-20_db5c1a4132da6d0e4ada655e38dbd3da_coinminer_dosia_glassworm_hive_poet-rat_quasar-rat_snatch.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-20_db5c1a4132da6d0e4ada655e38dbd3da_coinminer_dosia_glassworm_hive_poet-rat_quasar-rat_snatch.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-20_db5c1a4132da6d0e4ada655e38dbd3da_coinminer_dosia_glassworm_hive_poet-rat_quasar-rat_snatch.exe
- Size 36.6MB
- Sample260820-ysk2hafe77
- SHA256 1365dd404fcd7b1f7158383b52b92c8e0cabfa371fb80ba1d045eab3d78dc20a
- MD5 db5c1a4132da6d0e4ada655e38dbd3da
- SHA1 2947b63a6903fb2b1bf14837d7d94139bd6ee3c1
- SHA512 57852e940fdb9a8e95853c68c02ec4e4c5ed2b7de159bda5952a4c0c4e576398ab542f78154ce81f2302af08db15ddcd034acbe71c1b66b97a9fc297e9ea9fca
- SSDEEP 196608:PKRqOApPoM7W1XTcxLvSI4I22DBVll2A+8NL:PWeP40L2+l28
- TLSH T1DF877D67E46774A5C5ADC13CC63665237EB93889433023D71B54F6602BB3FE0A9BA390
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects Windows executables referencing non-Windows User-Agents 1 IoCs
resource yara_rule behavioral2/memory/3164-0-0x00007FF757C50000-0x00007FF75B9D1000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA - UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule behavioral2/memory/3164-0-0x00007FF757C50000-0x00007FF75B9D1000-memory.dmp UPX -
resource yara_rule behavioral2/memory/3164-0-0x00007FF757C50000-0x00007FF75B9D1000-memory.dmp upx
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_db5c1a4132da6d0e4ada655e38dbd3da_coinminer_dosia_glassworm_hive_poet-rat_quasar-rat_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-20_db5c1a4132da6d0e4ada655e38dbd3da_coinminer_dosia_glassworm_hive_poet-rat_quasar-rat_snatch.exe"1⤵PID:3164