Overview

overview

10

Static

static

10

2026-08-22...ch.exe

windows10-2004-x64

1

2026-08-22...ch.exe

windows11-ltsc_2024-x64

1

Analysis

  • max time kernel
    149s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    23/08/2026, 06:31

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-22_74840d5060498d0cce0a8c01a5f5a1f4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  • Size 11.7MB
  • Sample260823-hag9wseq21
  • SHA256 efbe2d05e61b60f34ae41b39740308c66a670c559817d9f1a1c5b18f41a9f599
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-22_74840d5060498d0cce0a8c01a5f5a1f4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-22_74840d5060498d0cce0a8c01a5f5a1f4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
    1⤵
      PID:2940

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          .statekey
          • Path C:\Users\Admin\.cache\dataplane\.statekey
          • Size 32B
          • SHA256 b76fcf0c2e95f4e0ac1d335bd6e32ddaee19d191c12fca27487936dd47054f2a
          • MD5 SHA1 SHA512
          Submit Download

          decisions.jsonl
          • Path C:\Users\Admin\.cache\dataplane\decisions.jsonl
          • Size 4KB
          • SHA256 63c8e228e04bfa39c08c2fc39becbebed4946d48cca5eeb918fc053aee13de3a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          state.json.tmp.2940
          • Path C:\Users\Admin\AppData\Local\Temp\TestBodyDecodeBypassClosed2435935981\002\state.json.tmp.2940
          • Size 16KB
          • SHA256 7650a56c6d1f2dfcb66d2ee5a7e170d9c85a5d9137384e5dbec99f2d1c8f4ac1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          .state_signed
          • Path C:\Users\Admin\AppData\Local\Temp\TestBodyDecodeBypassClosed2435935981\003\.state_signed
          • Size 25B
          • SHA256 71c69e19fc2dfccc36f22650429558a3b92165e56a60a1618e7ed7bc283eeb5c
          • MD5 SHA1 SHA512
          Submit Download

          state.json
          • Path C:\Users\Admin\AppData\Local\Temp\TestBreadcrumbHeaderInjection158701482\001\state.json
          • Size 16KB
          • SHA256 ed853c1190473f9e8d74389feba5b8467f62a6cfdcf900190ee6a79c29c2972f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          a.example.com.key
          • Path C:\Users\Admin\AppData\Local\Temp\TestCachedExpiryRejectsMismatchedPair1978238174\001\a.example.com.key
          • Size 241B
          • SHA256 cb5eaa6316d024fb650d055e5240302ee9490790a6b3d68bb5b947a53b290582
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          clientca.pem
          • Path C:\Users\Admin\AppData\Local\Temp\TestClientCAHotReload4049181120\001\clientca.pem
          • Size 63B
          • SHA256 d96d9825ac7973554f4dd7941dfb1551cc31eb160012f26310acbf5c5e9f58c4
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          .state_signed
          • Path C:\Users\Admin\AppData\Local\Temp\TestDLPEgressPaddingBlocked1993244310\001\.state_signed
          • Size 25B
          • SHA256 93588a12d7365a3b610047104c679cb679a4225900d9a90b1a6c98ffe3d71aae
          • MD5 SHA1 SHA512
          Submit Download

          .state_signed
          • Path C:\Users\Admin\AppData\Local\Temp\TestDivertBaitHasBeacon610181659\001\.state_signed
          • Size 25B
          • SHA256 aa7c636ea33f6320b093addd911fd6ad48cc7333a1d0bc3393de87bc3e3f3638
          • MD5 SHA1 SHA512
          Submit Download

          state.json.tmp.2940
          • Path C:\Users\Admin\AppData\Local\Temp\TestDivertToPoison2981442161\003\state.json.tmp.2940
          • Size 16KB
          • SHA256 904b298241bb28dd6f090cf5c44dc06176797544f6955ba3a2d2f741737123f4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          .state_signed
          • Path C:\Users\Admin\AppData\Local\Temp\TestForwardedProtoAuthoritative1298682038\001\.state_signed
          • Size 25B
          • SHA256 e154b60556d1d3c1b5ffff46611aa77c585dcd0ff6be1eb108ed1704bf340b82
          • MD5 SHA1 SHA512
          Submit Download

          .state_signed
          • Path C:\Users\Admin\AppData\Local\Temp\TestGraphqlGetTransportEnforcedPOST_body_enforcement_is_unchang3423589472\002\.state_signed
          • Size 25B
          • SHA256 c3a51d15f6eac048b7e4ea3ef59cb38c5df9540c7790cbaf062442ed7d148a8b
          • MD5 SHA1 SHA512
          Submit Download

          .state_signed
          • Path C:\Users\Admin\AppData\Local\Temp\TestHTTP2PrefaceRejected4267944606\001\.state_signed
          • Size 25B
          • SHA256 8f276079cb22cccb5bd850bea8f6c807ee2f04916e693a527569b8e8907b2c0e
          • MD5 SHA1 SHA512
          Submit Download

          .state_signed
          • Path C:\Users\Admin\AppData\Local\Temp\TestLedgerChainCatchesAnEditedLine1302527254\001\.state_signed
          • Size 25B
          • SHA256 ea3778fbf7b60e364d2f230085ad6f82f46b7d094bd98453f927ebe6804f3d12
          • MD5 SHA1 SHA512
          Submit Download

          .statekey
          • Path C:\Users\Admin\AppData\Local\Temp\TestLedgerChainSurvivesRestart2002755122\001\.statekey
          • Size 32B
          • SHA256 895c81145877f5094db1e52f4543b27f6eea4608da458105c4dc798db052bdfb
          • MD5 SHA1 SHA512
          Submit Download

          state.json.hw
          • Path C:\Users\Admin\AppData\Local\Temp\TestLedgerChainSurvivesRestart2002755122\001\state.json.hw
          • Size 96B
          • SHA256 70337bece65f4506f40efb773414080cacdd3ec68d3bcbb66c2d1f6de98d1b80
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          decisions.jsonl.2
          • Path C:\Users\Admin\AppData\Local\Temp\TestLedgerChainSurvivesRotation614639739\001\decisions.jsonl.2
          • Size 938B
          • SHA256 fbf968767655308c24883b9b2ffc122ce6cdf6efd62666c4af8a4f1f045f6783
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          decisions.jsonl
          • Path C:\Users\Admin\AppData\Local\Temp\TestLedgerChainVerifiesOversizedFile4230731588\001\decisions.jsonl
          • Size 1.0MB
          • SHA256 bee88fdb543a9b1fae04debe35491a27369a0dc6e0a403847a855f120c21b040
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          .state_signed
          • Path C:\Users\Admin\AppData\Local\Temp\TestLedgerOffWritesNothing3137513160\001\.state_signed
          • Size 25B
          • SHA256 1f5b9d658606812e4879c2e4a1ca988b421033499613400e3692c0755bc2397e
          • MD5 SHA1 SHA512
          Submit Download

          .state_signed
          • Path C:\Users\Admin\AppData\Local\Temp\TestProxyDisabledPassthrough1616366578\001\.state_signed
          • Size 25B
          • SHA256 19931ec80e464a6c67e7f9f110136324900547bf24d3e1ee86525823b6b57366
          • MD5 SHA1 SHA512
          Submit Download

          .state_signed
          • Path C:\Users\Admin\AppData\Local\Temp\TestRequireTLSNotBypassableByHeader4119358121\001\.state_signed
          • Size 25B
          • SHA256 e1ff5d1a20562752e89841f5003eea2a4bac0bfc2c1ec3023b652f65aba93d47
          • MD5 SHA1 SHA512
          Submit Download

          .state_signed
          • Path C:\Users\Admin\AppData\Local\Temp\TestSanitizeDoesNotBypassUploadScan2355924590\001\.state_signed
          • Size 25B
          • SHA256 0e642564562bda9263818b442e0088c942a3bc2ca47aabbd9bf045bed53b3953
          • MD5 SHA1 SHA512
          Submit Download

          .state_signed
          • Path C:\Users\Admin\AppData\Local\Temp\TestScanBodyMaxSecDoesNotSkipInspection#00229344171\001\.state_signed
          • Size 25B
          • SHA256 3d08798d472f0ac441d2bb026f0c9fe4eed94799eb1dfb6eb68d5feac0fe5e4b
          • MD5 SHA1 SHA512
          Submit Download

          state.json
          • Path C:\Users\Admin\AppData\Local\Temp\TestSyntheticReconContent1680598632\001\state.json
          • Size 16KB
          • SHA256 8f11a78c084e61d3ce7ee9c3623f97d8f0f2915689b0cef2a94b9a0d8053c0e8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          state.json.tmp.2940
          • Path C:\Users\Admin\AppData\Local\Temp\TestWatermarkPathKeepsEgressDefenses4270916325\002\state.json.tmp.2940
          • Size 16KB
          • SHA256 323cee8721fe0854a1ca251ac8cf7c08f7acdf7c0dc54f16cb551601f4f98b98
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          .state_signed
          • Path C:\Users\Admin\AppData\Local\Temp\TestWebSocketGenuine101StillPipes1287592182\001\.state_signed
          • Size 25B
          • SHA256 d77f5d1775dbc8fd19645b60abca6a3de158b265a87b45029da87ee3a1c763a0
          • MD5 SHA1 SHA512
          Submit Download

          state.json.tmp.2940
          • Path C:\Users\Admin\AppData\Local\Temp\TestZeroBodyScanCapDoesNotDisableScanning268867658\001\state.json.tmp.2940
          • Size 16KB
          • SHA256 a6efadde3f3be04e15295b732cc8a5ae57a5a074d948519e85744435d29b2e71
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          .state_signed
          • Path C:\Users\Admin\AppData\Local\Temp\TestZeroBodyScanCapDoesNotDisableScanning268867658\003\.state_signed
          • Size 25B
          • SHA256 3d468e4370e0764f40021eabbfd620c92f6227b99a93979db2782d4490897b73
          • MD5 SHA1 SHA512
          Submit Download