Analysis
- max time kernel
150s - max time network
111s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
26/08/2026, 01:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-25_f8a584dcd37353f576ab20710dc72142_coinminer_dosia_glassworm_hijackloader_poet-rat_quasar-rat_snatch.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-25_f8a584dcd37353f576ab20710dc72142_coinminer_dosia_glassworm_hijackloader_poet-rat_quasar-rat_snatch.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-08-25_f8a584dcd37353f576ab20710dc72142_coinminer_dosia_glassworm_hijackloader_poet-rat_quasar-rat_snatch.exe
- Size 10.1MB
- Sample260826-bkhvvabd33
- SHA256 8c668cfd0d0368bb5ae4ff61066de7399a56da3bce3fdba723d218bfb229e92e
- MD5 f8a584dcd37353f576ab20710dc72142
- SHA1 bfefe57c5a33100413546b87f6f4bb5885a864fd
- SHA512 242dd66bf7d7ea056e0d394f14ab6c7e19ea54ef1a3f3316b7278fa4cca7a95894c8390f50f1bff375696a68c341b1ab3abc609f6d896a66f5903ac68214414f
- SSDEEP 196608:V+LNHs/ntdG3Nb+LEjH6+tEUIrbbKkUBVDjhy:VoVsvtUbaEW+LCEVD9y
- TLSH T18CB6AE13EC59D8E5D1AED130896691B37B217C481B3123D76BA0B6387FB6BD0ADB9304
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 4788 powershell.exe 5152 powershell.exe 4884 powershell.exe 3800 powershell.exe 3196 powershell.exe 360 powershell.exe - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 3268 2026-08-25_f8a584dcd37353f576ab20710dc72142_coinminer_dosia_glassworm_hijackloader_poet-rat_quasar-rat_snatch.exe 3268 2026-08-25_f8a584dcd37353f576ab20710dc72142_coinminer_dosia_glassworm_hijackloader_poet-rat_quasar-rat_snatch.exe 3268 2026-08-25_f8a584dcd37353f576ab20710dc72142_coinminer_dosia_glassworm_hijackloader_poet-rat_quasar-rat_snatch.exe 3268 2026-08-25_f8a584dcd37353f576ab20710dc72142_coinminer_dosia_glassworm_hijackloader_poet-rat_quasar-rat_snatch.exe 4788 powershell.exe 4788 powershell.exe 5152 powershell.exe 3196 powershell.exe 5152 powershell.exe 3196 powershell.exe 3800 powershell.exe 3800 powershell.exe 4884 powershell.exe 4884 powershell.exe 360 powershell.exe 360 powershell.exe 4788 powershell.exe 3196 powershell.exe 3800 powershell.exe 4884 powershell.exe 5152 powershell.exe 360 powershell.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4788 powershell.exe Token: SeDebugPrivilege 5152 powershell.exe Token: SeDebugPrivilege 3196 powershell.exe Token: SeDebugPrivilege 3800 powershell.exe Token: SeDebugPrivilege 4884 powershell.exe Token: SeDebugPrivilege 360 powershell.exe Token: SeIncreaseQuotaPrivilege 4884 powershell.exe Token: SeSecurityPrivilege 4884 powershell.exe Token: SeTakeOwnershipPrivilege 4884 powershell.exe Token: SeLoadDriverPrivilege 4884 powershell.exe Token: SeSystemProfilePrivilege 4884 powershell.exe Token: SeSystemtimePrivilege 4884 powershell.exe Token: SeProfSingleProcessPrivilege 4884 powershell.exe Token: SeIncBasePriorityPrivilege 4884 powershell.exe Token: SeCreatePagefilePrivilege 4884 powershell.exe Token: SeBackupPrivilege 4884 powershell.exe Token: SeRestorePrivilege 4884 powershell.exe Token: SeShutdownPrivilege 4884 powershell.exe Token: SeDebugPrivilege 4884 powershell.exe Token: SeSystemEnvironmentPrivilege 4884 powershell.exe Token: SeRemoteShutdownPrivilege 4884 powershell.exe Token: SeUndockPrivilege 4884 powershell.exe Token: SeManageVolumePrivilege 4884 powershell.exe Token: 33 4884 powershell.exe Token: 34 4884 powershell.exe Token: 35 4884 powershell.exe Token: 36 4884 powershell.exe Token: SeIncreaseQuotaPrivilege 4788 powershell.exe Token: SeSecurityPrivilege 4788 powershell.exe Token: SeTakeOwnershipPrivilege 4788 powershell.exe Token: SeLoadDriverPrivilege 4788 powershell.exe Token: SeSystemProfilePrivilege 4788 powershell.exe Token: SeSystemtimePrivilege 4788 powershell.exe Token: SeProfSingleProcessPrivilege 4788 powershell.exe Token: SeIncBasePriorityPrivilege 4788 powershell.exe Token: SeCreatePagefilePrivilege 4788 powershell.exe Token: SeBackupPrivilege 4788 powershell.exe Token: SeRestorePrivilege 4788 powershell.exe Token: SeShutdownPrivilege 4788 powershell.exe Token: SeDebugPrivilege 4788 powershell.exe Token: SeSystemEnvironmentPrivilege 4788 powershell.exe Token: SeRemoteShutdownPrivilege 4788 powershell.exe Token: SeUndockPrivilege 4788 powershell.exe Token: SeManageVolumePrivilege 4788 powershell.exe Token: 33 4788 powershell.exe Token: 34 4788 powershell.exe Token: 35 4788 powershell.exe Token: 36 4788 powershell.exe Token: SeIncreaseQuotaPrivilege 3800 powershell.exe Token: SeSecurityPrivilege 3800 powershell.exe Token: SeTakeOwnershipPrivilege 3800 powershell.exe Token: SeLoadDriverPrivilege 3800 powershell.exe Token: SeSystemProfilePrivilege 3800 powershell.exe Token: SeSystemtimePrivilege 3800 powershell.exe Token: SeProfSingleProcessPrivilege 3800 powershell.exe Token: SeIncBasePriorityPrivilege 3800 powershell.exe Token: SeCreatePagefilePrivilege 3800 powershell.exe Token: SeBackupPrivilege 3800 powershell.exe Token: SeRestorePrivilege 3800 powershell.exe Token: SeShutdownPrivilege 3800 powershell.exe Token: SeDebugPrivilege 3800 powershell.exe Token: SeSystemEnvironmentPrivilege 3800 powershell.exe Token: SeRemoteShutdownPrivilege 3800 powershell.exe Token: SeUndockPrivilege 3800 powershell.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3268 wrote to memory of 4788 3268 2026-08-25_f8a584dcd37353f576ab20710dc72142_coinminer_dosia_glassworm_hijackloader_poet-rat_quasar-rat_snatch.exe 89 PID 3268 wrote to memory of 5152 3268 2026-08-25_f8a584dcd37353f576ab20710dc72142_coinminer_dosia_glassworm_hijackloader_poet-rat_quasar-rat_snatch.exe 90 PID 3268 wrote to memory of 4884 3268 2026-08-25_f8a584dcd37353f576ab20710dc72142_coinminer_dosia_glassworm_hijackloader_poet-rat_quasar-rat_snatch.exe 91 PID 3268 wrote to memory of 3800 3268 2026-08-25_f8a584dcd37353f576ab20710dc72142_coinminer_dosia_glassworm_hijackloader_poet-rat_quasar-rat_snatch.exe 95 PID 3268 wrote to memory of 3196 3268 2026-08-25_f8a584dcd37353f576ab20710dc72142_coinminer_dosia_glassworm_hijackloader_poet-rat_quasar-rat_snatch.exe 96 PID 3268 wrote to memory of 360 3268 2026-08-25_f8a584dcd37353f576ab20710dc72142_coinminer_dosia_glassworm_hijackloader_poet-rat_quasar-rat_snatch.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-25_f8a584dcd37353f576ab20710dc72142_coinminer_dosia_glassworm_hijackloader_poet-rat_quasar-rat_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-25_f8a584dcd37353f576ab20710dc72142_coinminer_dosia_glassworm_hijackloader_poet-rat_quasar-rat_snatch.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4788
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5152
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess 'Dism.exe'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4884
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess 'where.exe'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3800
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionExtension '.tmp'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3196
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionExtension '.zip'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:360
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 749aaba736648e246b89ae3a6987b644bd1a90bcc2e9f73bfbf9eb03a77c32e9
- MD5 0dce6d83f83e969fe1fdc72a9a725044
- SHA1 7d2c7e5be785b06fc9c922c924c7436d3b8cfd7a
- SHA512 bb1f033d5c7e7d56518c5e8e038075d98ce1151d05f6f219a7b04661ae7c36b2c4b5cd2ec8ddf758f401543db7673381f1d657e6537b82d22f5e04bcc6f7d31c
- TLSH T1D1216833F3DD8614C89A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
- MD5 acbc65123954839a819fa2495d239bf7
- SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
- SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
- TLSH T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 f1e5d82b5a189ea2be5bcb97eaf21b4ff8cb785bf14b9b7d0c3532a3cd068d60
- MD5 22f0ffaa212f3eff78593bfdeee03662
- SHA1 1464dfc97fd5c12669e86a3ebf2c748910c3a0c0
- SHA512 cfa263d4dc671f524387464ef486912af1d32d2ca39594a346e17f511050f9ef98e8c20f042c67e367ba60eaa39abdb1d677bb570ed9d05101e17b8441faeb63
- TLSH T170216833B3DD8614CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 82fb99dc0cd12ba5e5b7a360092f848d2fbb2775d12ccb3aa60d8b3710ccc91a
- MD5 9e67f340014cbaf62f2fb8c7a539d21b
- SHA1 f0ed976f190cbdf1b9b643c93b97d101cb87e3ae
- SHA512 9c86e7c8cfd1971b16e7b82d6ab9c9539e115402d205efff6f2ef941bc0e09a479e31ecff8a3510c8c7ade3f65cdab7b4f1eda357438b854be29349aaccb93e6
- TLSH T1E7216833B3DD8614C89A413A10CDAC1036B6C7DB40DECFAB7B84E659A43F699CE61160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 435471b87a1a97b0e29f7d5dd0878e63031511f063629d7e750852c068e7c4f5
- MD5 81b56f1dad28119d54bf23c83fc570b9
- SHA1 cb9a89a716465611149ce3c700bd60681d434faf
- SHA512 77bd4d53ca86d66d29ba662dd424e94e5cef46c6a460cbf9f8d87a40c627401c0f6d0fe30258c23ed1cf63df1a70b19288885a33c206fb85a19f12efaab61927
- TLSH T1F3216833B3DD8614C89A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qdfknrf0.bpf.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH