Overview

overview

10

Static

static

10

2026-08-22...ch.exe

windows10-2004-x64

1

2026-08-22...ch.exe

windows11-ltsc_2024-x64

1

Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    23/08/2026, 06:31

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-22_74840d5060498d0cce0a8c01a5f5a1f4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  • Size 11.7MB
  • Sample260823-hag9wseq21
  • SHA256 efbe2d05e61b60f34ae41b39740308c66a670c559817d9f1a1c5b18f41a9f599
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-22_74840d5060498d0cce0a8c01a5f5a1f4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-22_74840d5060498d0cce0a8c01a5f5a1f4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
    1⤵
      PID:4884

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          .statekey
          • Path C:\Users\Admin\.cache\dataplane\.statekey
          • Size 32B
          • SHA256 e915eda6c5fc209bdfbd84d422d2079eba5c932087008e6d539bd192483b77b4
          • MD5 SHA1 SHA512
          Submit Download

          decisions.jsonl
          • Path C:\Users\Admin\.cache\dataplane\decisions.jsonl
          • Size 4KB
          • SHA256 57209714bbaf8c4ff3acf93e2f3efffb64acc4e12e99f87e48e1ef4d9a1772d1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          state.json.tmp.4884
          • Path C:\Users\Admin\AppData\Local\Temp\TestBodyDecodeBypassClosed2973366447\002\state.json.tmp.4884
          • Size 16KB
          • SHA256 c2b30b7fc3b1c4a5fb004ddd06d561c2c6778a17163d5294c89a4e96fee618f0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          .state_signed
          • Path C:\Users\Admin\AppData\Local\Temp\TestBodyDecodeFailClosed2016441879\002\.state_signed
          • Size 25B
          • SHA256 ea3778fbf7b60e364d2f230085ad6f82f46b7d094bd98453f927ebe6804f3d12
          • MD5 SHA1 SHA512
          Submit Download

          state.json
          • Path C:\Users\Admin\AppData\Local\Temp\TestBreadcrumbHeaderInjection1092147926\001\state.json
          • Size 16KB
          • SHA256 16cf9c306dcdcbf4af696c8c01ea186de77f90770d3ae21f39f2bed15dbb5984
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          .state_signed
          • Path C:\Users\Admin\AppData\Local\Temp\TestBufferFullBodyMaxSecGuard1368783133\001\.state_signed
          • Size 25B
          • SHA256 e1ff5d1a20562752e89841f5003eea2a4bac0bfc2c1ec3023b652f65aba93d47
          • MD5 SHA1 SHA512
          Submit Download

          a.example.com.key
          • Path C:\Users\Admin\AppData\Local\Temp\TestCachedExpiryRejectsMismatchedPair3816630180\001\a.example.com.key
          • Size 241B
          • SHA256 15847a8284fe4ce535cec7b3eb49d5615e551961caad6429e2cd645af3aad161
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          clientca.pem
          • Path C:\Users\Admin\AppData\Local\Temp\TestClientCAHotReload4187509932\001\clientca.pem
          • Size 63B
          • SHA256 d96d9825ac7973554f4dd7941dfb1551cc31eb160012f26310acbf5c5e9f58c4
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          .state_signed
          • Path C:\Users\Admin\AppData\Local\Temp\TestDLPEgressHeaderLeakBlocked2553174394\001\.state_signed
          • Size 25B
          • SHA256 10217345485ad13488b3734719dcfca3412d2aac52687b4d81e11e00a4239f75
          • MD5 SHA1 SHA512
          Submit Download

          state.json.tmp.4884
          • Path C:\Users\Admin\AppData\Local\Temp\TestDivertToPoison2178008669\003\state.json.tmp.4884
          • Size 16KB
          • SHA256 682eff894801158defc6999447e2ad81920c7e937d403f7db544c5be756d420f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          .state_signed
          • Path C:\Users\Admin\AppData\Local\Temp\TestForwardedProtoAuthoritative2000221452\001\.state_signed
          • Size 25B
          • SHA256 eadac030cb8a6f09b19d77f989c6e353375b840e8d4a9d07d6225625b6d48679
          • MD5 SHA1 SHA512
          Submit Download

          .state_signed
          • Path C:\Users\Admin\AppData\Local\Temp\TestGraphqlGetTransportEnforcedPOST_body_enforcement_is_unchang1460885621\002\.state_signed
          • Size 25B
          • SHA256 62dbd8e8525443dc38c1f1589b5cdec06176571922f7813a698b413ca8b6cdd8
          • MD5 SHA1 SHA512
          Submit Download

          .state_signed
          • Path C:\Users\Admin\AppData\Local\Temp\TestGraphqlGetTransportEnforcedattack_over_GET_is_blocked191414072\001\.state_signed
          • Size 25B
          • SHA256 aa7c636ea33f6320b093addd911fd6ad48cc7333a1d0bc3393de87bc3e3f3638
          • MD5 SHA1 SHA512
          Submit Download

          .state_signed
          • Path C:\Users\Admin\AppData\Local\Temp\TestHTTP2PrefaceRejected198847573\001\.state_signed
          • Size 25B
          • SHA256 c00941bd86d818b51d6d59ed3fb72b10a21e3e86ecaedea3625cb93543b4c82c
          • MD5 SHA1 SHA512
          Submit Download

          .state_signed
          • Path C:\Users\Admin\AppData\Local\Temp\TestIngressNeverExceedsBytesSent1475397648\005\.state_signed
          • Size 25B
          • SHA256 e16ce62aa3a42b6743776ab1387e0eb52f0c34a5dc28118934448ab70c07648e
          • MD5 SHA1 SHA512
          Submit Download

          .state_signed
          • Path C:\Users\Admin\AppData\Local\Temp\TestL4Passthrough1479106184\001\.state_signed
          • Size 25B
          • SHA256 c92b4875e6b1b39d9c0525270e85b62651dbb1bca4288712b5b61118e17fc985
          • MD5 SHA1 SHA512
          Submit Download

          .statekey
          • Path C:\Users\Admin\AppData\Local\Temp\TestLedgerChainSurvivesRestart1897420613\001\.statekey
          • Size 32B
          • SHA256 b8d483c540c503096d67174eafb7ec6fca160dc0fa8c3158dd8c79a36487d343
          • MD5 SHA1 SHA512
          Submit Download

          state.json.hw
          • Path C:\Users\Admin\AppData\Local\Temp\TestLedgerChainSurvivesRestart1897420613\001\state.json.hw
          • Size 96B
          • SHA256 352253a8cca1529024d346cfa4a70c3f26657ed2bb0c188b147c2e85fc41423b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          decisions.jsonl
          • Path C:\Users\Admin\AppData\Local\Temp\TestLedgerChainVerifiesOversizedFile2123970556\001\decisions.jsonl
          • Size 2.5MB
          • SHA256 9f5bbd8ff8b1671593c2a21d87595f78c6604fb0bf5bf4bba367ce696cb35bd9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          .state_signed
          • Path C:\Users\Admin\AppData\Local\Temp\TestLedgerOffWritesNothing1623232504\001\.state_signed
          • Size 25B
          • SHA256 c3a51d15f6eac048b7e4ea3ef59cb38c5df9540c7790cbaf062442ed7d148a8b
          • MD5 SHA1 SHA512
          Submit Download

          decisions.jsonl
          • Path C:\Users\Admin\AppData\Local\Temp\TestLedgerRateLimitIsPerRuleNotPerSource1462700695\001\decisions.jsonl
          • Size 2KB
          • SHA256 695f2f0be3c7a3162812e12c2c3d246cadb3e52bb251e66bc96af05e75b8c3a4
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          .state_signed
          • Path C:\Users\Admin\AppData\Local\Temp\TestLedgerTailCheckedReportsWhenHeadMissing3594077802\001\.state_signed
          • Size 25B
          • SHA256 93588a12d7365a3b610047104c679cb679a4225900d9a90b1a6c98ffe3d71aae
          • MD5 SHA1 SHA512
          Submit Download

          decisions.jsonl
          • Path C:\Users\Admin\AppData\Local\Temp\TestLedgerTailCheckedReportsWhenHeadMissing3594077802\001\decisions.jsonl
          • Size 582B
          • SHA256 91805deeebfc72a7943f471f05e65963b45e1e6f162e68b19d60daa4ed29af2a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          .state_signed
          • Path C:\Users\Admin\AppData\Local\Temp\TestRequireTLSNotBypassableByHeader365603110\001\.state_signed
          • Size 25B
          • SHA256 40ccb3be9ebee60a9f5644d7119c7b5e8eccdf1b612fbcee6fc9916e8877b25a
          • MD5 SHA1 SHA512
          Submit Download

          .state_signed
          • Path C:\Users\Admin\AppData\Local\Temp\TestResponseThreatSurvivesDLPShortCircuitspast_the_DLP_sampling679311261\003\.state_signed
          • Size 25B
          • SHA256 f10bc78583a10a01adba4899fdf9d7e5829971e520141223f6549332edbcfa03
          • MD5 SHA1 SHA512
          Submit Download

          .state_signed
          • Path C:\Users\Admin\AppData\Local\Temp\TestScanBodyMaxSecDoesNotSkipInspection#003485506958\001\.state_signed
          • Size 25B
          • SHA256 d77f5d1775dbc8fd19645b60abca6a3de158b265a87b45029da87ee3a1c763a0
          • MD5 SHA1 SHA512
          Submit Download

          .state_signed
          • Path C:\Users\Admin\AppData\Local\Temp\TestSyntheticReconContent2785748320\001\.state_signed
          • Size 25B
          • SHA256 1f5b9d658606812e4879c2e4a1ca988b421033499613400e3692c0755bc2397e
          • MD5 SHA1 SHA512
          Submit Download

          state.json
          • Path C:\Users\Admin\AppData\Local\Temp\TestSyntheticReconContent2785748320\001\state.json
          • Size 16KB
          • SHA256 080e14d0bfcab14803fb538ca5c6bdcd7765f75ddaa73d631516d907678db96c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          .state_signed
          • Path C:\Users\Admin\AppData\Local\Temp\TestWatermarkPathAppliesTheDLPPolicy1769693892\003\.state_signed
          • Size 25B
          • SHA256 8011021ed8a1852701cfd848f7707628312e2aa120d019a632d1fd806fd7855a
          • MD5 SHA1 SHA512
          Submit Download

          state.json.tmp.4884
          • Path C:\Users\Admin\AppData\Local\Temp\TestWatermarkPathKeepsEgressDefenses3346387493\002\state.json.tmp.4884
          • Size 16KB
          • SHA256 94a19bd551b0d8e340f6074010222b7b7c813964c63d9cd1d9e4d4e1427f8222
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          state.json.tmp.4884
          • Path C:\Users\Admin\AppData\Local\Temp\TestZeroBodyScanCapDoesNotDisableScanning3068832521\001\state.json.tmp.4884
          • Size 16KB
          • SHA256 da6483fec6b4b10a9f30ffbbc9f283e1e266c97d2d5cfc56fdc327419f995ef3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          .state_signed
          • Path C:\Users\Admin\AppData\Local\Temp\TestZeroBodyScanCapDoesNotDisableScanning3068832521\003\.state_signed
          • Size 25B
          • SHA256 c9ff8cd9b465cd0870892c323c9e3416fb05b9992646b0465b77ba35e4fd1109
          • MD5 SHA1 SHA512
          Submit Download