Overview

overview

10

Static

static

10

2026-08-22...ch.exe

windows10-2004-x64

1

2026-08-22...ch.exe

windows11-ltsc_2024-x64

1

Analysis

  • max time kernel
    150s
  • max time network
    142s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    23/08/2026, 04:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-22_953c6c510dfbf9f55f5fee8570ff414a_coinminer_dosia_glassworm_malwareactor_omgwtfbbqapt_poet-rat_quasar-rat_snatch.exe
  • Size 10.3MB
  • Sample260823-e9kbraxwf1
  • SHA256 8af31d17ec5dc3f52c8bc50b85e202d5d27a98ffc636426ca4168bb7e2e13a77
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-22_953c6c510dfbf9f55f5fee8570ff414a_coinminer_dosia_glassworm_malwareactor_omgwtfbbqapt_poet-rat_quasar-rat_snatch.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-22_953c6c510dfbf9f55f5fee8570ff414a_coinminer_dosia_glassworm_malwareactor_omgwtfbbqapt_poet-rat_quasar-rat_snatch.exe"
    1⤵
      PID:1116

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          .statekey
          • Path C:\Users\Admin\.cache\dataplane\.statekey
          • Size 32B
          • SHA256 cf9476542f0499832df669198aae2c7b17ae3643eb83385c7aa05ff0ff083262
          • MD5 SHA1 SHA512
          Submit Download

          users.json.hw
          • Path C:\Users\Admin\AppData\Local\Temp\TestAccountRehashOnLogin3025109231\001\users.json.hw
          • Size 96B
          • SHA256 401d6cc1db508f7fc5ba25a32ab08d9f70b0e84ccaf467ed9bec3a45087ba6fa
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          u.json.hw
          • Path C:\Users\Admin\AppData\Local\Temp\TestAccountStoreCRUD4041108631\001\u.json.hw
          • Size 96B
          • SHA256 8f5b30c3c3678f0a4166db831f910575fa249881e2caac73fa8451c4b55cad93
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          audit.jsonl
          • Path C:\Users\Admin\AppData\Local\Temp\TestAuditAnchoredAfterRotation2085669476\001\audit.jsonl
          • Size 83B
          • SHA256 94c09860aec4fb46dfbb6ced56a1f4ab65054271765b400ab269ccbcf6e80022
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          audit.jsonl.head
          • Path C:\Users\Admin\AppData\Local\Temp\TestAuditAnchoredAfterRotation2085669476\001\audit.jsonl.head
          • Size 147B
          • SHA256 be1e011969847e87cedff550d4765ea491ecf78c5f6b49fc1faa02c7ec0ea1a0
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          audit.jsonl
          • Path C:\Users\Admin\AppData\Local\Temp\TestAuditExportFullTrail2451886028\001\audit.jsonl
          • Size 549B
          • SHA256 0b50a8f0e61c46945e796ad7137b4038075de789651a1540a38cd8c1e297b06e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          audit.jsonl
          • Path C:\Users\Admin\AppData\Local\Temp\TestAuditTailTruncationDetected1545740758\001\audit.jsonl
          • Size 338B
          • SHA256 af305d6571e80d3066cfe28df6e86d3ac93ccdb8df53bf746eccdf92272e0f5d
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          .statekey
          • Path C:\Users\Admin\AppData\Local\Temp\TestCampaignsAndSTIX1319768411\001\.statekey
          • Size 32B
          • SHA256 01285d6bd0f4c540356661bf58aa36e564072979ac807ae0a59eb995dda2d02f
          • MD5 SHA1 SHA512
          Submit Download

          admin_audit.jsonl
          • Path C:\Users\Admin\AppData\Local\Temp\TestConfigSaveSpamHTTP448910219\001\admin_audit.jsonl
          • Size 5KB
          • SHA256 aca9c50aaeae6f89ddaac7125b2cc96e0c5c8d5f621f61b3782ae3f659425ec4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pending_changes.json
          • Path C:\Users\Admin\AppData\Local\Temp\TestConfigSaveSpamHTTP448910219\001\pending_changes.json
          • Size 2KB
          • SHA256 b30b6e0f24705607d7777ecd18aea437cefc52aa8d30f4d625aaaaff15bdb89c
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          pending_changes.json
          • Path C:\Users\Admin\AppData\Local\Temp\TestConfigSaveSpamHTTP448910219\001\pending_changes.json
          • Size 4KB
          • SHA256 47cba83bc8fb72979f094179b5fd7734df8ec5e926d35d005268ec1164eb0f6f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pending_changes.json.hw
          • Path C:\Users\Admin\AppData\Local\Temp\TestConfigSaveSpamHTTP448910219\001\pending_changes.json.hw
          • Size 96B
          • SHA256 cba39f9d4644b37081e299a47f2bc62dc6b0f00ad0fce178066c5133187cab4d
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          .statekey
          • Path C:\Users\Admin\AppData\Local\Temp\TestDecoyAuthGate1073880381\001\.statekey
          • Size 32B
          • SHA256 2e15ecd54db5859dd4f8d7e4be12da3b57adbf97c875bc6528a0a0ed8b057e5e
          • MD5 SHA1 SHA512
          Submit Download

          .statekey
          • Path C:\Users\Admin\AppData\Local\Temp\TestDecoyClosedRoutes3042074803\001\.statekey
          • Size 32B
          • SHA256 b204822e45d0097cc72099f0eafc125e1883fd5faecc817582d3b20292dde48f
          • MD5 SHA1 SHA512
          Submit Download

          .statekey
          • Path C:\Users\Admin\AppData\Local\Temp\TestDecoyCookieIsCanary706746214\001\.statekey
          • Size 32B
          • SHA256 1ab1844e49f09d0db810486dca59f0cbd8d46f34af62c352a1b0034748323eb0
          • MD5 SHA1 SHA512
          Submit Download

          .statekey
          • Path C:\Users\Admin\AppData\Local\Temp\TestDecoyCredentialBoundSuccess2387536033\001\.statekey
          • Size 32B
          • SHA256 7404b054b1e834496085d84679c63263a3ea03e63c61d372deb5664f4765c77f
          • MD5 SHA1 SHA512
          Submit Download

          .statekey
          • Path C:\Users\Admin\AppData\Local\Temp\TestDecoyHoneytokenAssets1124816262\001\.statekey
          • Size 32B
          • SHA256 8da0ba0edf2266bf7e05c52dac03ca768308423825694150d107264240575795
          • MD5 SHA1 SHA512
          Submit Download

          .statekey
          • Path C:\Users\Admin\AppData\Local\Temp\TestDecoyInfraHarvest2185084105\001\.statekey
          • Size 32B
          • SHA256 0335bd0ecade9dc1bd69205aa19025a62f55f32aa866207e8de75a2d5c52898c
          • MD5 SHA1 SHA512
          Submit Download

          .statekey
          • Path C:\Users\Admin\AppData\Local\Temp\TestDecoyIntelSanitization1118257393\001\.statekey
          • Size 32B
          • SHA256 cde7bf6b8013b05dfebb2094237212e2a85573700d6bbf78dcf746138e6ff14e
          • MD5 SHA1 SHA512
          Submit Download

          .statekey
          • Path C:\Users\Admin\AppData\Local\Temp\TestDecoyPerBootMetrics1069123249\001\.statekey
          • Size 32B
          • SHA256 11a6e9277596f948dedd290d32ee996a37f1badca41be2f48b02cd7a616156f0
          • MD5 SHA1 SHA512
          Submit Download

          .statekey
          • Path C:\Users\Admin\AppData\Local\Temp\TestDecoyScanAndSupport1000562513\001\.statekey
          • Size 32B
          • SHA256 466e6c3d6ab2066e95afa50edde4a0e1a5d5b8948db04355fd4093a6812e0bfa
          • MD5 SHA1 SHA512
          Submit Download

          .statekey
          • Path C:\Users\Admin\AppData\Local\Temp\TestDecoySchemaUnified2086141022\001\.statekey
          • Size 32B
          • SHA256 3d51bc9c2dad5131a97cfce43852f407bfbf66b1f24ede45ab6da7a5e7377fe6
          • MD5 SHA1 SHA512
          Submit Download

          .statekey
          • Path C:\Users\Admin\AppData\Local\Temp\TestDecoyStatefulTheatre3466376319\001\.statekey
          • Size 32B
          • SHA256 ff323ab0f1cc48561dcf2bb32b7f4c7c36319476f2241e09b826955ab547bc59
          • MD5 SHA1 SHA512
          Submit Download

          .statekey
          • Path C:\Users\Admin\AppData\Local\Temp\TestDecoyTarpitOff3657916966\001\.statekey
          • Size 32B
          • SHA256 3044b1be73d98b9803a4e4da5cb2ec2233ec9a19becc7f06f3c0637448e50b2a
          • MD5 SHA1 SHA512
          Submit Download

          .statekey
          • Path C:\Users\Admin\AppData\Local\Temp\TestDecoyVerificationProbeDetector3083392262\001\.statekey
          • Size 32B
          • SHA256 0e6c1f3d6b22e16906ff034a04074d5cb3e257ddfb1c778ff23c0bd6c1eb7489
          • MD5 SHA1 SHA512
          Submit Download

          .statekey
          • Path C:\Users\Admin\AppData\Local\Temp\TestHoneypotBypassForOperator3076524065\001\.statekey
          • Size 32B
          • SHA256 1e77e877543b1217b47dde5058bd7df1179f5261aee880c7b298074130f97b12
          • MD5 SHA1 SHA512
          Submit Download

          .statekey
          • Path C:\Users\Admin\AppData\Local\Temp\TestHoneypotDecoyIsInert2621580434\001\.statekey
          • Size 32B
          • SHA256 343d89a4edf9ddf501258936f0ea11d734c77a9673a0ba78205811ce345309bf
          • MD5 SHA1 SHA512
          Submit Download

          .statekey
          • Path C:\Users\Admin\AppData\Local\Temp\TestHoneypotFakeSuccess1021441689\001\.statekey
          • Size 32B
          • SHA256 a0e3e14ee612e0a8eb516cb641bc5edd392fcf53bb16f8cf0b4230190fcc3df0
          • MD5 SHA1 SHA512
          Submit Download

          .statekey
          • Path C:\Users\Admin\AppData\Local\Temp\TestHoneypotTrapDivertsToDecoy1675934905\001\.statekey
          • Size 32B
          • SHA256 bf0e1d02b217da35205f00f6c0448ae0e0789d66e753e27b9a2a790f8dec5e10
          • MD5 SHA1 SHA512
          Submit Download

          .statekey
          • Path C:\Users\Admin\AppData\Local\Temp\TestLoginFlow1267295065\001\.statekey
          • Size 32B
          • SHA256 ad9618d4bcb83a657599db71259c7326826538994334ba3d5d98e9ee0ead92f9
          • MD5 SHA1 SHA512
          Submit Download

          state.json
          • Path C:\Users\Admin\AppData\Local\Temp\TestPresetEndpoints330451587\001\state.json
          • Size 15KB
          • SHA256 96bad7d5951cd40d3f1e4230e3dad71652b6a99af054e17f243b11adc8debf76
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          .statekey
          • Path C:\Users\Admin\AppData\Local\Temp\TestPrivEscViaLegacyPassword4280915327\001\.statekey
          • Size 32B
          • SHA256 922aa003b444dd29ec76aa776123450d1301f4702f1af74849ea8cfc7e37a28e
          • MD5 SHA1 SHA512
          Submit Download

          state.json
          • Path C:\Users\Admin\AppData\Local\Temp\TestPrivEscViaLegacyPassword4280915327\001\state.json
          • Size 15KB
          • SHA256 1b1ca2456ab8170ca478ba3f8c961f527b36d812e27a790d0267354a5e09dbb5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          profile.json
          • Path C:\Users\Admin\AppData\Local\Temp\TestProfileStealthEndpoints293467141\001\profile.json
          • Size 48B
          • SHA256 13fd73baa9c41d2868efaf4f1fc53402d339e412bda76b8ee509174076d513ba
          • MD5 SHA1 SHA512
          Submit Download

          profile.json
          • Path C:\Users\Admin\AppData\Local\Temp\TestProfileStealthEndpoints293467141\001\profile.json
          • Size 49B
          • SHA256 583ef493052f33ccffd08772250b3b1411ca23d9497782d1d2fb6af4474635e4
          • MD5 SHA1 SHA512
          Submit Download

          .state_signed
          • Path C:\Users\Admin\AppData\Local\Temp\TestReportSummaryNeverLeaksAPlaceholder743322831\005\.state_signed
          • Size 25B
          • SHA256 0b0ae2fb9eb2ad032938f00c68a8b0dc48a99b4972fae75cb7c77e90cc0ece1c
          • MD5 SHA1 SHA512
          Submit Download

          .statekey
          • Path C:\Users\Admin\AppData\Local\Temp\TestStateSnapshotEndpoint2848404063\001\.statekey
          • Size 32B
          • SHA256 0a059c6f2a31e29049fb73cc4b2ad7530ae245ba7805d2c565a1e185a0a82fc7
          • MD5 SHA1 SHA512
          Submit Download

          blocklist.json.hw
          • Path C:\Users\Admin\AppData\Local\Temp\TestStateSnapshotEndpoint2848404063\001\blocklist.json.hw
          • Size 96B
          • SHA256 540925374bfafd0831f7c7c05bc1852b534bb525812d626431c28e706fcd088a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          profile.json
          • Path C:\Users\Admin\AppData\Local\Temp\TestStealthCoverNameEscapedInHTML3396426053\001\profile.json
          • Size 61B
          • SHA256 017c04e71483e0c0f580830512796fb9269485bbeddd8c3453ae194b0ec95e21
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          .state_signed
          • Path C:\Users\Admin\AppData\Local\Temp\TestTokenAuthedRejectsEmpty1809162201\001\.state_signed
          • Size 25B
          • SHA256 6c55b24f4a8452369c795bc258f75a30e0d8faeb51770e039056b7a37f485459
          • MD5 SHA1 SHA512
          Submit Download