Analysis

  • max time kernel
    148s
  • max time network
    130s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    23/08/2026, 03:42

General

  • Target
    2026-08-22_a02e5013c529a8f4a4769d486ee52f92_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  • Size 11.7MB
  • Sample260823-d9ektsdr2w
  • SHA256 d1eb8a87a70fe8b8de244a9e2035c7ad8d8ddbdc9251319c190741e31cf3472d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-22_a02e5013c529a8f4a4769d486ee52f92_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-22_a02e5013c529a8f4a4769d486ee52f92_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
    1⤵
      PID:1164

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          .statekey

          • Path C:\Users\Admin\.cache\dataplane\.statekey
          • Size 32B
          • SHA256 0d47b247c934309cf79ed625c064639e94fa06e23c852fc91fdafebd93b1fcd8
          • MD5 SHA1 SHA512

          decisions.jsonl

          • Path C:\Users\Admin\.cache\dataplane\decisions.jsonl
          • Size 4KB
          • SHA256 f357319c901c346c0bb62107e75141f6314ec2cb133584c0059b3360acad7a89
          • MD5 SHA1 SHA512 SSDEEP TLSH

          state.json.tmp.1164

          • Path C:\Users\Admin\AppData\Local\Temp\TestBodyDecodeBypassClosed916886492\002\state.json.tmp.1164
          • Size 16KB
          • SHA256 8e2c13bb9f4260e055da888438b49a2d11863b74ece93da4e73d65ed9c43e692
          • MD5 SHA1 SHA512 SSDEEP TLSH

          state.json

          • Path C:\Users\Admin\AppData\Local\Temp\TestBreadcrumbHeaderInjection4135583528\001\state.json
          • Size 16KB
          • SHA256 338f32718d78193d7cc360ba4956d8f1a2a03f804293aeec57151c7dd091f936
          • MD5 SHA1 SHA512 SSDEEP TLSH

          a.example.com.key

          • Path C:\Users\Admin\AppData\Local\Temp\TestCachedExpiryRejectsMismatchedPair775562738\001\a.example.com.key
          • Size 241B
          • SHA256 b8b9733a2ed71d80f8636a0318e31838cf54c1cbe0d435871e1c06b9388438ef
          • MD5 SHA1 SHA512 TLSH

          clientca.pem

          • Path C:\Users\Admin\AppData\Local\Temp\TestClientCAHotReload2880377832\001\clientca.pem
          • Size 63B
          • SHA256 d96d9825ac7973554f4dd7941dfb1551cc31eb160012f26310acbf5c5e9f58c4
          • MD5 SHA1 SHA512 TLSH

          .state_signed

          • Path C:\Users\Admin\AppData\Local\Temp\TestDLPEgressOversizedHeadScanned2815772065\001\.state_signed
          • Size 25B
          • SHA256 3a157c673f05489cd8449294cdfe5b8d0a0ac9ddd577546aa2876edbeb3ec7dc
          • MD5 SHA1 SHA512

          state.json.tmp.1164

          • Path C:\Users\Admin\AppData\Local\Temp\TestDivertToPoison589411227\003\state.json.tmp.1164
          • Size 16KB
          • SHA256 4a20d5d56d5cc436a12552d4f1aa1160dd9d54dad97176230c3d8a4717f9ee3b
          • MD5 SHA1 SHA512 SSDEEP TLSH

          .state_signed

          • Path C:\Users\Admin\AppData\Local\Temp\TestEphemeralModeWritesNothing1501488570\001\.state_signed
          • Size 25B
          • SHA256 faffccd4078669b4ab61e7106625b2d3893cce471406cbeee39af1a98b965c9f
          • MD5 SHA1 SHA512

          .state_signed

          • Path C:\Users\Admin\AppData\Local\Temp\TestForwardedProtoAuthoritative4191424802\001\.state_signed
          • Size 25B
          • SHA256 df89d2ec5833e23e03ef6bf091f10d03e27767ad508011eb7ac6d34ca4aeeb87
          • MD5 SHA1 SHA512

          .state_signed

          • Path C:\Users\Admin\AppData\Local\Temp\TestHTTP2PrefaceRejected288448117\001\.state_signed
          • Size 25B
          • SHA256 a1746e151bd8cfdb4a019405fb2637eab4d2750249b6ce8e4b86a541f3ab6b3d
          • MD5 SHA1 SHA512

          .state_signed

          • Path C:\Users\Admin\AppData\Local\Temp\TestIngressCountsEachByteOnce_BodyAfterHead3103725864\001\.state_signed
          • Size 25B
          • SHA256 e7d13240ac8a390dcb728d27e092633a402065c6de528104e1df004e956e425c
          • MD5 SHA1 SHA512

          .statekey

          • Path C:\Users\Admin\AppData\Local\Temp\TestLedgerChainSurvivesRestart3846862701\001\.statekey
          • Size 32B
          • SHA256 0d89d2cba72d7d0c27d5b6e31966fe375f93dd8a2588fea3f5d65410c7777397
          • MD5 SHA1 SHA512

          state.json.hw

          • Path C:\Users\Admin\AppData\Local\Temp\TestLedgerChainSurvivesRestart3846862701\001\state.json.hw
          • Size 96B
          • SHA256 53b3aabb87dd72118b616e44b3e70744fc9aaea68ddcdabbbe6bdb5b2fa366c6
          • MD5 SHA1 SHA512 TLSH

          decisions.jsonl.2

          • Path C:\Users\Admin\AppData\Local\Temp\TestLedgerChainSurvivesRotation3024691041\001\decisions.jsonl.2
          • Size 938B
          • SHA256 8be1ddee9203d509c576b0c8fd72a702bf371f57a9ed02044ab76e6d5b8f60ae
          • MD5 SHA1 SHA512 TLSH

          decisions.jsonl

          • Path C:\Users\Admin\AppData\Local\Temp\TestLedgerChainVerifiesOversizedFile463632877\001\decisions.jsonl
          • Size 2.1MB
          • SHA256 bc3f1c1bf7c4e0335fbe771f5a457e709e53313ee08a5ca6cf2a9edd756adda6
          • MD5 SHA1 SHA512 SSDEEP TLSH

          .state_signed

          • Path C:\Users\Admin\AppData\Local\Temp\TestLedgerOffWritesNothing1759465673\001\.state_signed
          • Size 25B
          • SHA256 059c8f5eb3fb8fd15f7d3867a13b5d620ac05a5336246c784a7b2aa6337d1bc6
          • MD5 SHA1 SHA512

          decisions.jsonl

          • Path C:\Users\Admin\AppData\Local\Temp\TestLedgerTailCheckedReportsWhenHeadMissing2584349328\001\decisions.jsonl
          • Size 582B
          • SHA256 3b8a58d0012445f3584bee20cb63a6c83c8eb049246247c765cf928303b64319
          • MD5 SHA1 SHA512 TLSH

          .state_signed

          • Path C:\Users\Admin\AppData\Local\Temp\TestMaxHeadBytesConfigurable1895719972\002\.state_signed
          • Size 25B
          • SHA256 160cdc83b60afa6de7841533c8676be355ecf51805168654eade1385b2b7fdca
          • MD5 SHA1 SHA512

          .state_signed

          • Path C:\Users\Admin\AppData\Local\Temp\TestProxyChunkedBodyBypass1837897339\001\.state_signed
          • Size 25B
          • SHA256 b79e9a4a9508670bdf5c6d3c155e283757ac9d8f2cfe6378c09b2e7104fd8db7
          • MD5 SHA1 SHA512

          .state_signed

          • Path C:\Users\Admin\AppData\Local\Temp\TestProxyJSONLog1789448405\001\.state_signed
          • Size 25B
          • SHA256 91d9b87b9d4b9f1fabe3e10f4777ba3e33a8385d7956da28d2ef0ae574802434
          • MD5 SHA1 SHA512

          .state_signed

          • Path C:\Users\Admin\AppData\Local\Temp\TestRequireTLSNotBypassableByHeader2928798195\001\.state_signed
          • Size 25B
          • SHA256 adf645624c2c513df6c3741c25ae4007c7db50303c661cde77d4b2aade642bdf
          • MD5 SHA1 SHA512

          .state_signed

          • Path C:\Users\Admin\AppData\Local\Temp\TestSanitizeDirectMislabeledSVGDisarmed2526477472\001\.state_signed
          • Size 25B
          • SHA256 9c8fce32ab952c00ecc1f43e0f92e92ce5a6e33c1fb9facbefdf9f1688f0e3ed
          • MD5 SHA1 SHA512

          .state_signed

          • Path C:\Users\Admin\AppData\Local\Temp\TestSanitizeDoesNotBypassUploadScan6335134\001\.state_signed
          • Size 25B
          • SHA256 10555130f5b5e2ebd3f6fa14b658672659d282d73aff916ddf4dadf12bf3dc26
          • MD5 SHA1 SHA512

          .state_signed

          • Path C:\Users\Admin\AppData\Local\Temp\TestSiteName320469461\001\.state_signed
          • Size 25B
          • SHA256 3eea85dceac2b011658fddfcf50ec92370fb9568ce17cfff89ac24014e5f1ce5
          • MD5 SHA1 SHA512

          .state_signed

          • Path C:\Users\Admin\AppData\Local\Temp\TestSyntheticReconContent1406255358\001\.state_signed
          • Size 25B
          • SHA256 ffe5fa85af6ed961a7fd6e9c2bfc030af0dd9611d68dd389e6ca0c3ee9531edb
          • MD5 SHA1 SHA512

          state.json

          • Path C:\Users\Admin\AppData\Local\Temp\TestSyntheticReconContent1406255358\001\state.json
          • Size 16KB
          • SHA256 359ac1a3d3947be59960dace78f245884b6034f2818cffacc7ec36866bc2e022
          • MD5 SHA1 SHA512 SSDEEP TLSH

          .state_signed

          • Path C:\Users\Admin\AppData\Local\Temp\TestVerifyDecisionsReportsRatherThanRefusing2469857372\001\.state_signed
          • Size 25B
          • SHA256 73c89749d5b7ecb1f7093c53f8280a70c75dc8c0b7697a6c6add0f938e5517d7
          • MD5 SHA1 SHA512

          state.json.tmp.1164

          • Path C:\Users\Admin\AppData\Local\Temp\TestWatermarkPathKeepsEgressDefenses3942440018\002\state.json.tmp.1164
          • Size 16KB
          • SHA256 bbbcee23f3ef713eab82f996c65ef743c964ba24bf165c373cdba84d87ccd5b9
          • MD5 SHA1 SHA512 SSDEEP TLSH

          state.json.tmp.1164

          • Path C:\Users\Admin\AppData\Local\Temp\TestZeroBodyScanCapDoesNotDisableScanning3172692959\001\state.json.tmp.1164
          • Size 16KB
          • SHA256 0ee84b2e6a5764172b591a43a81772955133c403a9de7b97d7be4af3c9ae240c
          • MD5 SHA1 SHA512 SSDEEP TLSH

          .state_signed

          • Path C:\Users\Admin\AppData\Local\Temp\fnproxy1435936627\.state_signed
          • Size 25B
          • SHA256 e158f38a99d47bc25402dbf99593ff166db8e701bd8d456a019da672afa4a006
          • MD5 SHA1 SHA512