9bfd26a40b1efe4a05017e826e52ae07a1297ba6275d9fefd2f02338b549509a

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/08/2026, 13:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-28_7d77ddb70f8cc72096a545daaf2d3123_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 7.0MB
Sample260828-qv2s2aycla
SHA256 9bfd26a40b1efe4a05017e826e52ae07a1297ba6275d9fefd2f02338b549509a
MD5 7d77ddb70f8cc72096a545daaf2d3123
SHA1 728233c540df80193dcac7db1bb52b3350b6c74e
SHA512 805ee2d42b6f7899d7b466a7ab389195cdc4771e5853c1f481cb23d52752e96ff289d01c202c2d085b43ed975f3c681bb8bd700f164822b1ef2c2b9eeec72461
SSDEEP 98304:skESYU6ndpptmJz33CeaFOumvBh8huT+E:sQt6ndpXiL3CFy
TLSH
T179763907ECA554E9C0AEC13189639562BF717C485B3123D32B50F6386F76BE0AEBA750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4204	powershell.exe
2340	powershell.exe
5744	powershell.exe
4368	powershell.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
4204	powershell.exe
4204	powershell.exe
2340	powershell.exe
2340	powershell.exe
2340	powershell.exe
5744	powershell.exe
5744	powershell.exe
5744	powershell.exe
4368	powershell.exe
4368	powershell.exe
4368	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4204	powershell.exe
Token: SeDebugPrivilege	2340	powershell.exe
Token: SeDebugPrivilege	5744	powershell.exe
Token: SeDebugPrivilege	4368	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 4204	2004	2026-08-28_7d77ddb70f8cc72096a545daaf2d3123_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	89
PID 2004 wrote to memory of 2340	2004	2026-08-28_7d77ddb70f8cc72096a545daaf2d3123_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	92
PID 2004 wrote to memory of 5744	2004	2026-08-28_7d77ddb70f8cc72096a545daaf2d3123_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	94
PID 2004 wrote to memory of 4368	2004	2026-08-28_7d77ddb70f8cc72096a545daaf2d3123_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-08-28_7d77ddb70f8cc72096a545daaf2d3123_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-28_7d77ddb70f8cc72096a545daaf2d3123_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject -Query \"select Name from Win32_Processor\").Name"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4204
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject -Query \"Select Name from Win32_VideoController\").Name"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2340
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject -Query \"select * from Win32_OperatingSystem\").Caption"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5744
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject -Query \"select TotalPhysicalMemory from Win32_ComputerSystem\").TotalPhysicalMemory"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 088977fcbe7c67abb42aa190c4767ef8d609471ecaf28a308f13be0f76970885
MD5 cf8ff4f9b33ad76c84603e8465acffe2
SHA1 5cd36f1bb91b463456a7423dd73fb3401c57cf81
SHA512 33c226e854c81a19d12e32865e5f16b4fa53c22ddbd9ad3371ed0336ff32a6dc834a75d521be9bf405c119cb510f29c8809363e18e28d9ab58a48f37e93a489b
TLSH
T1B5115733B3CC8724C89A413650CEAC1136B597DB91DECE6B7B84D158A83F599DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 bcf8325db72c06bb7f6a8df3c4648a150d766a1857214c6b533c467029424ce8
MD5 e6bcee6109b84febc5ffa8c6d9b2a547
SHA1 eb5de5de4575f11fea9fb8a5f72aee1c8b5b3dab
SHA512 3081253140a770e4c68087b76b905286143feb2fbafa1e0b284b50f69ec736153f85fad9305d7e7f1309d98cf470edea4ab89da3941e068631116d03cccf5333
TLSH
T1C6115733B3CC8624CC9A403650CEAC1036B587DB509EDF6BBB84D145B83F599DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_m1hgndaj.pd4.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_m1hgndaj.pd4.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4204-8-0x00007FFB792F0000-0x00007FFB79C94000-memory.dmp

Download

memory/4204-6-0x00007FFB792F0000-0x00007FFB79C94000-memory.dmp

Download

memory/4204-7-0x00007FFB792F0000-0x00007FFB79C94000-memory.dmp

Download

memory/4204-0-0x00007FFB7947F000-0x00007FFB79480000-memory.dmp

Download

memory/4204-9-0x00007FFB792F0000-0x00007FFB79C94000-memory.dmp

Download

memory/4204-11-0x00007FFB792F0000-0x00007FFB79C94000-memory.dmp

Download

memory/4204-12-0x00007FFB792F0000-0x00007FFB79C94000-memory.dmp

Download

memory/4204-4-0x000001FFFFFA0000-0x000001FFFFFC2000-memory.dmp

Download

memory/4204-5-0x00007FFB792F0000-0x00007FFB79C94000-memory.dmp

Download

memory/4204-3-0x00007FFB792F0000-0x00007FFB79C94000-memory.dmp

Download