Overview

overview

10

Static

static

10

2026-08-22...ch.exe

windows10-2004-x64

1

2026-08-22...ch.exe

windows11-ltsc_2024-x64

1

Analysis

  • max time kernel
    150s
  • max time network
    142s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    23/08/2026, 04:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-22_96ce28abd7648d5968f6ce3e18389aa4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  • Size 11.7MB
  • Sample260823-e4vwasxwcw
  • SHA256 648f9619f84d734965427c759ba594daccc2c955ee0de291cc3cc89b9136f30b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-22_96ce28abd7648d5968f6ce3e18389aa4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-22_96ce28abd7648d5968f6ce3e18389aa4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
    1⤵
      PID:3392

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          .statekey
          • Path C:\Users\Admin\.cache\dataplane\.statekey
          • Size 32B
          • SHA256 f39bd59bdffd11500e260375f6154718fe4e78498ff050a8c5095a44e4b05e23
          • MD5 SHA1 SHA512
          Submit Download

          decisions.jsonl
          • Path C:\Users\Admin\.cache\dataplane\decisions.jsonl
          • Size 4KB
          • SHA256 6e238dc72a4de401810603dd34e078296cdef629d0868c9e64936564d7cb953f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          state.json.tmp.3392
          • Path C:\Users\Admin\AppData\Local\Temp\TestBodyDecodeBypassClosed780598239\002\state.json.tmp.3392
          • Size 16KB
          • SHA256 3817a90b0ad4f84b232987b23b6c642ef37bf2f137335b84a9885478a7285872
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          state.json
          • Path C:\Users\Admin\AppData\Local\Temp\TestBreadcrumbHeaderInjection851446566\001\state.json
          • Size 16KB
          • SHA256 af70c477c339dfccd1de6d1c388b55ca964fed02607da9d24c9893c9b6f735fb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          a.example.com.key
          • Path C:\Users\Admin\AppData\Local\Temp\TestCachedExpiryRejectsMismatchedPair509399657\001\a.example.com.key
          • Size 241B
          • SHA256 84e1bff91c18699e8f0298ff627bb0c3955595bbeaee2cf3e9b2d9a20e20fb02
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          .state_signed
          • Path C:\Users\Admin\AppData\Local\Temp\TestChunkedLegitBodyIntact1074419298\001\.state_signed
          • Size 25B
          • SHA256 0ca50080b4c67a153616df1499cd19caa5abded49547ac9e28a31166feade190
          • MD5 SHA1 SHA512
          Submit Download

          clientca.pem
          • Path C:\Users\Admin\AppData\Local\Temp\TestClientCAHotReload446066969\001\clientca.pem
          • Size 63B
          • SHA256 d96d9825ac7973554f4dd7941dfb1551cc31eb160012f26310acbf5c5e9f58c4
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          .state_signed
          • Path C:\Users\Admin\AppData\Local\Temp\TestDLPEgressDecodeCleanGzipPasses2034562623\001\.state_signed
          • Size 25B
          • SHA256 a5c5cd09bd798feb751b0fce1005db15e4c41df089e07ec469cac40b3a170233
          • MD5 SHA1 SHA512
          Submit Download

          state.json.tmp.3392
          • Path C:\Users\Admin\AppData\Local\Temp\TestDivertToPoison1011857911\003\state.json.tmp.3392
          • Size 16KB
          • SHA256 baae244c33962a60526437c6bacba49e7ec505db1d44fad2d7e1dd865d51e526
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          .state_signed
          • Path C:\Users\Admin\AppData\Local\Temp\TestEphemeralModeWritesNothing2134127701\001\.state_signed
          • Size 25B
          • SHA256 933b6670b140640c687a3d69d11d501e94ac65c158499437c73b8ba49a7e3d1b
          • MD5 SHA1 SHA512
          Submit Download

          .state_signed
          • Path C:\Users\Admin\AppData\Local\Temp\TestForwardedProtoAuthoritative607762853\001\.state_signed
          • Size 25B
          • SHA256 731e335665abea2d17843d9bc72c5e9b38cbdbb95b1c26513303c41ec394b46d
          • MD5 SHA1 SHA512
          Submit Download

          .state_signed
          • Path C:\Users\Admin\AppData\Local\Temp\TestHTTP2PrefaceRejected4129569707\001\.state_signed
          • Size 25B
          • SHA256 9e990816a68c8c7655944c66a690bfbc96e5535b926476246fafa39dbda920f7
          • MD5 SHA1 SHA512
          Submit Download

          .state_signed
          • Path C:\Users\Admin\AppData\Local\Temp\TestIngressCountsEachByteOnce_BodyAfterHead3992480431\001\.state_signed
          • Size 25B
          • SHA256 c3edec0185547743e7661e85415d65f9926c36d942ea915458bb078d214c569d
          • MD5 SHA1 SHA512
          Submit Download

          .state_signed
          • Path C:\Users\Admin\AppData\Local\Temp\TestIngressNeverExceedsBytesSent4118175671\004\.state_signed
          • Size 25B
          • SHA256 69156f5934e99fbc33961e4f0b3ced6801cf3cd6b86deb11eeb79af79cf23b2f
          • MD5 SHA1 SHA512
          Submit Download

          .statekey
          • Path C:\Users\Admin\AppData\Local\Temp\TestLedgerChainSurvivesRestart1201039226\001\.statekey
          • Size 32B
          • SHA256 b6cab0565cfdad5d2ff089b9222df6aea51e2f27561ce66bc7273f8a8f34eecb
          • MD5 SHA1 SHA512
          Submit Download

          state.json.hw
          • Path C:\Users\Admin\AppData\Local\Temp\TestLedgerChainSurvivesRestart1201039226\001\state.json.hw
          • Size 96B
          • SHA256 c048e73879341afd6a762b3f6a34f704d7297bbbe8f182062649d54c1456d06c
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          decisions.jsonl.2
          • Path C:\Users\Admin\AppData\Local\Temp\TestLedgerChainSurvivesRotation4062073430\001\decisions.jsonl.2
          • Size 938B
          • SHA256 b50112b326ae218a10386c011feea10aab565adad71c67cff4e067b343744b5b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          decisions.jsonl
          • Path C:\Users\Admin\AppData\Local\Temp\TestLedgerChainVerifiesOversizedFile2279571943\001\decisions.jsonl
          • Size 1.1MB
          • SHA256 f8f4cb973d327ba2ad12a80a03f4a16a4ca71a7dac31af61dc33be9ed7db121b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          .state_signed
          • Path C:\Users\Admin\AppData\Local\Temp\TestLedgerOffWritesNothing2669355466\001\.state_signed
          • Size 25B
          • SHA256 f6c4e228bf7cea25938e2254b9633020c99e3585c65a5898d3b30c2d15f8c598
          • MD5 SHA1 SHA512
          Submit Download

          .state_signed
          • Path C:\Users\Admin\AppData\Local\Temp\TestLedgerTailCheckedReportsWhenHeadMissing2210138173\001\.state_signed
          • Size 25B
          • SHA256 b70eb1d61d0a7983b3b3da94434400e636cb69aebfd8d6dabdd85aed7c58ea9e
          • MD5 SHA1 SHA512
          Submit Download

          decisions.jsonl
          • Path C:\Users\Admin\AppData\Local\Temp\TestLedgerTailCheckedReportsWhenHeadMissing2210138173\001\decisions.jsonl
          • Size 582B
          • SHA256 ec6785d5520389c968ef6d62423984f3e1d76997a04c1ff23a1d81ff3b831bbb
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          .state_signed
          • Path C:\Users\Admin\AppData\Local\Temp\TestMaxHeadBytesConfigurable4062113017\001\.state_signed
          • Size 25B
          • SHA256 d4792e7bf279afd2f93ce5d697c280daadb85211be4f92eed30ef011ccfbd06d
          • MD5 SHA1 SHA512
          Submit Download

          .state_signed
          • Path C:\Users\Admin\AppData\Local\Temp\TestProxyJSONLogFile1080642838\001\.state_signed
          • Size 25B
          • SHA256 467dde6775d3dd909792cffc2515e156627f179e5f31792ac4a46c404b317809
          • MD5 SHA1 SHA512
          Submit Download

          .state_signed
          • Path C:\Users\Admin\AppData\Local\Temp\TestPseudoHeaderInjection2896778366\001\.state_signed
          • Size 25B
          • SHA256 d1adda0bdf2fd9d3e9143f8f9d235158fd27c3489fd4e584c8f4ec82e48d2676
          • MD5 SHA1 SHA512
          Submit Download

          .state_signed
          • Path C:\Users\Admin\AppData\Local\Temp\TestRequireTLSNotBypassableByHeader4105324060\001\.state_signed
          • Size 25B
          • SHA256 d5fdddbde0a5c340814dda7c34b6d35ecf88f3a2986f3c4859716ad0976d316b
          • MD5 SHA1 SHA512
          Submit Download

          .state_signed
          • Path C:\Users\Admin\AppData\Local\Temp\TestResponseMatchRoute4293495578\001\.state_signed
          • Size 25B
          • SHA256 b7e3829fe0af4d85a7fe4f122492cc1db64bf691f3c34f26e074360f1312501d
          • MD5 SHA1 SHA512
          Submit Download

          .state_signed
          • Path C:\Users\Admin\AppData\Local\Temp\TestServeForeverSurvivesRestartEndsOnStop3444028658\001\.state_signed
          • Size 25B
          • SHA256 606cfdc909f605bbb119d980efa62903d46407c3f2753e77e57f20d1af8fc19a
          • MD5 SHA1 SHA512
          Submit Download

          .state_signed
          • Path C:\Users\Admin\AppData\Local\Temp\TestSiteFrontingPredicate1071844064\001\.state_signed
          • Size 25B
          • SHA256 21adc53a76e0e56c06c9353456ec3379f19a3a300ae243736036b67a0f37b70f
          • MD5 SHA1 SHA512
          Submit Download

          .state_signed
          • Path C:\Users\Admin\AppData\Local\Temp\TestSyntheticReconContent3662020771\001\.state_signed
          • Size 25B
          • SHA256 126685a69e6533fe5fcb6685cb456e7a767b985acb478057b26ae9c328e25571
          • MD5 SHA1 SHA512
          Submit Download

          state.json
          • Path C:\Users\Admin\AppData\Local\Temp\TestSyntheticReconContent3662020771\001\state.json
          • Size 16KB
          • SHA256 bb4c763630a027b27e40ddf57dda1f5fdce1d686aa3051dee46e578a1da08ac3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          state.json.tmp.3392
          • Path C:\Users\Admin\AppData\Local\Temp\TestWatermarkPathKeepsEgressDefenses2146552498\002\state.json.tmp.3392
          • Size 16KB
          • SHA256 51bfbb7b305cbf561c862cc26133e962513886943118fe9431f23598c2c1ec51
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          state.json.tmp.3392
          • Path C:\Users\Admin\AppData\Local\Temp\TestZeroBodyScanCapDoesNotDisableScanning563807509\001\state.json.tmp.3392
          • Size 16KB
          • SHA256 08e1512d3bebc1d6156fc5fd5c76f26c6f0353fa2bca073967308604415ffc40
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          .state_signed
          • Path C:\Users\Admin\AppData\Local\Temp\fnproxy2353221985\.state_signed
          • Size 25B
          • SHA256 d13c3bcf6fe4a0433e50bb86cdbc2ddc9abeed303d59ffd5786a08bf6e7e117d
          • MD5 SHA1 SHA512
          Submit Download