Overview

overview

10

Static

static

10

2026-08-22...ch.exe

windows10-2004-x64

1

2026-08-22...ch.exe

windows11-ltsc_2024-x64

1

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    23/08/2026, 04:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-22_96ce28abd7648d5968f6ce3e18389aa4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  • Size 11.7MB
  • Sample260823-e4vwasxwcw
  • SHA256 648f9619f84d734965427c759ba594daccc2c955ee0de291cc3cc89b9136f30b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-22_96ce28abd7648d5968f6ce3e18389aa4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-22_96ce28abd7648d5968f6ce3e18389aa4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
    1⤵
      PID:5084

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          .statekey
          • Path C:\Users\Admin\.cache\dataplane\.statekey
          • Size 32B
          • SHA256 256df0c22547d0c077842a00df11f3cfdc980a340ce6d30ad3d8b75f4fd6237f
          • MD5 SHA1 SHA512
          Submit Download

          decisions.jsonl
          • Path C:\Users\Admin\.cache\dataplane\decisions.jsonl
          • Size 4KB
          • SHA256 a2be861f8e99a879caa6681ac1b42f7bbc2d5738d08a8a9806be3685f6e94d76
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          .state_signed
          • Path C:\Users\Admin\AppData\Local\Temp\TestBodyDecodeBypassClosed1771760304\002\.state_signed
          • Size 25B
          • SHA256 d13c3bcf6fe4a0433e50bb86cdbc2ddc9abeed303d59ffd5786a08bf6e7e117d
          • MD5 SHA1 SHA512
          Submit Download

          state.json.tmp.5084
          • Path C:\Users\Admin\AppData\Local\Temp\TestBodyDecodeBypassClosed1771760304\002\state.json.tmp.5084
          • Size 16KB
          • SHA256 84759f0d8051acc3e1c36b8c68da8d718a41b840d48ee8bf5fd90c0c9b0e8894
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          state.json
          • Path C:\Users\Admin\AppData\Local\Temp\TestBreadcrumbHeaderInjection730120291\001\state.json
          • Size 16KB
          • SHA256 62dd318b98bbefa78dd2240319c82f936631136b2850e44657701ebdffb9fce6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          a.example.com.key
          • Path C:\Users\Admin\AppData\Local\Temp\TestCachedExpiryRejectsMismatchedPair2994554694\001\a.example.com.key
          • Size 241B
          • SHA256 3c13cac0444db978593e7c1356f0a5435f5cd23e8504d25ef93348472c690e66
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          clientca.pem
          • Path C:\Users\Admin\AppData\Local\Temp\TestClientCAHotReload3961838632\001\clientca.pem
          • Size 63B
          • SHA256 d96d9825ac7973554f4dd7941dfb1551cc31eb160012f26310acbf5c5e9f58c4
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          .state_signed
          • Path C:\Users\Admin\AppData\Local\Temp\TestDLPMaskRedactsHeaderSecret1614547039\001\.state_signed
          • Size 25B
          • SHA256 f6c4e228bf7cea25938e2254b9633020c99e3585c65a5898d3b30c2d15f8c598
          • MD5 SHA1 SHA512
          Submit Download

          state.json.tmp.5084
          • Path C:\Users\Admin\AppData\Local\Temp\TestDivertToPoison3357742300\003\state.json.tmp.5084
          • Size 16KB
          • SHA256 c70f1e7b91243c0e70f3d5eb9b21819db9352af21025cef5fd67c1fdbe60b31a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          .state_signed
          • Path C:\Users\Admin\AppData\Local\Temp\TestForwardedProtoAuthoritative3031480218\001\.state_signed
          • Size 25B
          • SHA256 e3f5cd1b0b3051fbffe4ba35128335075ff2372fc8383ad1aa483c9014a17cc0
          • MD5 SHA1 SHA512
          Submit Download

          .state_signed
          • Path C:\Users\Admin\AppData\Local\Temp\TestHTTP2PrefaceRejected2044316990\001\.state_signed
          • Size 25B
          • SHA256 37e5e77b63515f768b68e61afcf7556c9959e21baa38e0ebc6bf165317a545f0
          • MD5 SHA1 SHA512
          Submit Download

          .state_signed
          • Path C:\Users\Admin\AppData\Local\Temp\TestIngressNeverExceedsBytesSent501827820\003\.state_signed
          • Size 25B
          • SHA256 933b6670b140640c687a3d69d11d501e94ac65c158499437c73b8ba49a7e3d1b
          • MD5 SHA1 SHA512
          Submit Download

          .state_signed
          • Path C:\Users\Admin\AppData\Local\Temp\TestLedgerChainCatchesAnEditedLine3907387107\001\.state_signed
          • Size 25B
          • SHA256 126685a69e6533fe5fcb6685cb456e7a767b985acb478057b26ae9c328e25571
          • MD5 SHA1 SHA512
          Submit Download

          .statekey
          • Path C:\Users\Admin\AppData\Local\Temp\TestLedgerChainSurvivesRestart963613354\001\.statekey
          • Size 32B
          • SHA256 81b6643167aba7609e06c7925b08b8c223b58b426c5787e861faef7e61e1c181
          • MD5 SHA1 SHA512
          Submit Download

          state.json.hw
          • Path C:\Users\Admin\AppData\Local\Temp\TestLedgerChainSurvivesRestart963613354\001\state.json.hw
          • Size 96B
          • SHA256 5e6d337c15839e4e457edffec0da46c5a8df99aef3553f3092d65ca7233772bf
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          decisions.jsonl.2
          • Path C:\Users\Admin\AppData\Local\Temp\TestLedgerChainSurvivesRotation183154068\001\decisions.jsonl.2
          • Size 938B
          • SHA256 3911bf28c172dde346c0c8869abe516e78c004117ec26f8c513a87ca2c33d238
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          decisions.jsonl
          • Path C:\Users\Admin\AppData\Local\Temp\TestLedgerChainVerifiesOversizedFile51507470\001\decisions.jsonl
          • Size 1.4MB
          • SHA256 73db895fbb1b20321c5d3a14cf3e1213e1c8ebb3da7f6269a16f6bcd8e150ceb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          .state_signed
          • Path C:\Users\Admin\AppData\Local\Temp\TestLedgerOffWritesNothing1371973703\001\.state_signed
          • Size 25B
          • SHA256 b70eb1d61d0a7983b3b3da94434400e636cb69aebfd8d6dabdd85aed7c58ea9e
          • MD5 SHA1 SHA512
          Submit Download

          decisions.jsonl
          • Path C:\Users\Admin\AppData\Local\Temp\TestLedgerTailCheckedReportsWhenHeadMissing1884573773\001\decisions.jsonl
          • Size 582B
          • SHA256 e537653322d5f7080c3b769e92824f2fe4282b3ff21f4ab90406a504eb706b7b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          .state_signed
          • Path C:\Users\Admin\AppData\Local\Temp\TestProxyJSONLog119492124\001\.state_signed
          • Size 25B
          • SHA256 c3edec0185547743e7661e85415d65f9926c36d942ea915458bb078d214c569d
          • MD5 SHA1 SHA512
          Submit Download

          .state_signed
          • Path C:\Users\Admin\AppData\Local\Temp\TestReadyzUnreachableBackend2124293011\001\.state_signed
          • Size 25B
          • SHA256 a5c5cd09bd798feb751b0fce1005db15e4c41df089e07ec469cac40b3a170233
          • MD5 SHA1 SHA512
          Submit Download

          .state_signed
          • Path C:\Users\Admin\AppData\Local\Temp\TestRequireTLSNotBypassableByHeader936485591\001\.state_signed
          • Size 25B
          • SHA256 0ca50080b4c67a153616df1499cd19caa5abded49547ac9e28a31166feade190
          • MD5 SHA1 SHA512
          Submit Download

          .state_signed
          • Path C:\Users\Admin\AppData\Local\Temp\TestSanitizeCleanMultipartStillForwarded2145749796\001\.state_signed
          • Size 25B
          • SHA256 9e990816a68c8c7655944c66a690bfbc96e5535b926476246fafa39dbda920f7
          • MD5 SHA1 SHA512
          Submit Download

          .state_signed
          • Path C:\Users\Admin\AppData\Local\Temp\TestScanBodyMaxSecDoesNotSkipInspection#003406754335\001\.state_signed
          • Size 25B
          • SHA256 d1adda0bdf2fd9d3e9143f8f9d235158fd27c3489fd4e584c8f4ec82e48d2676
          • MD5 SHA1 SHA512
          Submit Download

          state.json
          • Path C:\Users\Admin\AppData\Local\Temp\TestSyntheticReconContent1363585140\001\state.json
          • Size 16KB
          • SHA256 58cbd12f8dddf4d7889506dff1ed377cdc784ad6618704fad9764777fd575b33
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          .state_signed
          • Path C:\Users\Admin\AppData\Local\Temp\TestTxnRedactToggleOff3168905236\001\.state_signed
          • Size 25B
          • SHA256 88779c0ab66b035bb9e8aa8f3653ce2582fdbb30ec5b38187a651c22fd7bb36d
          • MD5 SHA1 SHA512
          Submit Download

          state.json.tmp.5084
          • Path C:\Users\Admin\AppData\Local\Temp\TestWatermarkPathKeepsEgressDefenses3661565752\002\state.json.tmp.5084
          • Size 16KB
          • SHA256 faf8bcf0a8592b2a672630782de350f1e41314812e023c11cb14793c0c4d104c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          state.json.tmp.5084
          • Path C:\Users\Admin\AppData\Local\Temp\TestZeroBodyScanCapDoesNotDisableScanning1129770873\001\state.json.tmp.5084
          • Size 16KB
          • SHA256 105f91d19aa9ae69096ca490690ec302a31b42e89205c127d0cccba171618a60
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download