Overview

overview

8

Static

static

3

2026-09-04...ch.exe

windows10-2004-x64

8

2026-09-04...ch.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    05/09/2026, 02:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-04_9caa21e87562682bf61c47070d6f8b68_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  • Size 6.9MB
  • Sample260905-cm66wsbd88
  • SHA256 55034f8533437e710d8f7b866f982de83a6c85e1350ccab7800111714e8fbd42
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoveryexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

    execution
  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 4 IoCs
  • Discovers running processes 1 TTPs 2 IoCs

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  • GoLang User-Agent 2 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-04_9caa21e87562682bf61c47070d6f8b68_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-04_9caa21e87562682bf61c47070d6f8b68_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3084
    • C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq server-remote.exe" /FI "PID ne 3084" /NH
      2⤵
      • Discovers running processes
      • Suspicious use of AdjustPrivilegeToken
      PID:1292
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -Command "$s = New-Object -ComObject WScript.Shell; $sc = $s.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Proxy Network.lnk'); $sc.TargetPath = 'C:\Users\Admin\AppData\Local\ProxyNetwork\server-remote.exe'; $sc.WorkingDirectory = 'C:\Users\Admin\AppData\Local\ProxyNetwork'; $sc.Description = 'Proxy Network bandwidth provider'; $sc.Save()"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Creates a file in the Startup directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4104
    • C:\Windows\system32\schtasks.exe
      schtasks /Delete /TN "ProxyNetwork Watchdog" /F
      2⤵
        PID:3656
      • C:\Windows\system32\schtasks.exe
        schtasks /Create /F /TN "ProxyNetwork Watchdog" /TR "\"C:\Users\Admin\AppData\Local\ProxyNetwork\server-remote.exe\" -watchdog" /SC MINUTE /MO 5 /RL LIMITED
        2⤵
        • Scheduled Task/Job: Scheduled Task
        PID:4764
      • C:\Users\Admin\AppData\Local\ProxyNetwork\server-remote.exe
        C:\Users\Admin\AppData\Local\ProxyNetwork\server-remote.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4672
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -WindowStyle Hidden -Command "$s = New-Object -ComObject WScript.Shell; $sc = $s.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Proxy Network.lnk'); $sc.TargetPath = 'C:\Users\Admin\AppData\Local\ProxyNetwork\server-remote.exe'; $sc.WorkingDirectory = 'C:\Users\Admin\AppData\Local\ProxyNetwork'; $sc.Description = 'Proxy Network bandwidth provider'; $sc.Save()"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Creates a file in the Startup directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5040
        • C:\Windows\system32\schtasks.exe
          schtasks /Delete /TN "ProxyNetwork Watchdog" /F
          3⤵
            PID:212
          • C:\Windows\system32\schtasks.exe
            schtasks /Create /F /TN "ProxyNetwork Watchdog" /TR "\"C:\Users\Admin\AppData\Local\ProxyNetwork\server-remote.exe\" -watchdog" /SC MINUTE /MO 5 /RL LIMITED
            3⤵
            • Scheduled Task/Job: Scheduled Task
            PID:3784
          • C:\Users\Admin\AppData\Local\ProxyNetwork\server-remote.exe
            C:\Users\Admin\AppData\Local\ProxyNetwork\server-remote.exe
            3⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:4552
            • C:\Users\Admin\AppData\Local\ProxyNetwork\server-remote.exe
              C:\Users\Admin\AppData\Local\ProxyNetwork\server-remote.exe
              4⤵
              • Executes dropped EXE
              PID:672
        • C:\Windows\system32\tasklist.exe
          tasklist /FI "IMAGENAME eq server-remote.exe" /FI "PID ne 3084" /NH
          2⤵
          • Discovers running processes
          • Suspicious use of AdjustPrivilegeToken
          PID:964
      • C:\Users\Admin\AppData\Local\ProxyNetwork\server-remote.exe
        "C:\Users\Admin\AppData\Local\ProxyNetwork\server-remote.exe"
        1⤵
        • Executes dropped EXE
        PID:1904

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            powershell.exe.log
            • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
            • Size 2KB
            • SHA256 3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 ea603a37a82d2716f8199f70cd9727ca8e63dc5d81dee960f12834e1dd2e5849
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            client.log
            • Path C:\Users\Admin\AppData\Local\ProxyNetwork\client.log
            • Size 241B
            • SHA256 c3b00d7c3445303a6981d99da8be1b57adbfabe0390ef38f9c61891d92aa1c6a
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            client.log
            • Path C:\Users\Admin\AppData\Local\ProxyNetwork\client.log
            • Size 760B
            • SHA256 4f0a155e3d7ba9c959016abfde4109e7341eff742967f586ed18c0ae6bdf80fc
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            server-remote.exe
            • Path C:\Users\Admin\AppData\Local\ProxyNetwork\server-remote.exe
            • Size 6.9MB
            • SHA256 55034f8533437e710d8f7b866f982de83a6c85e1350ccab7800111714e8fbd42
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            server-remote.exe
            • Path C:\Users\Admin\AppData\Local\ProxyNetwork\server-remote.exe
            • Size 7.0MB
            • SHA256 e404c30d9c901c60e9654c73a4bd7ea7c99ab34589ea66183e1c3ec6755505cd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            update-pending.json
            • Path C:\Users\Admin\AppData\Local\ProxyNetwork\update-pending.json
            • Size 96B
            • SHA256 f4644a87aa0a31cc22ea0f51b2833fa921f2709c16fa14e5237c07e6aae4b341
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            __PSScriptPolicyTest_tdgujbor.k2t.ps1
            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tdgujbor.k2t.ps1
            • Size 60B
            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Proxy Network.lnk
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Proxy Network.lnk
            • Size 1KB
            • SHA256 9389e5a63e8ed0ae8d2015943092b561966c5d2ebc82bb0e360f7a055caaaad0
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            memory/4104-1-0x000001F7E3FF0000-0x000001F7E4000000-memory.dmp
            Download

            memory/4104-9-0x000001F7E6170000-0x000001F7E6192000-memory.dmp
            Download

            memory/4552-38-0x00007FF608DD0000-0x00007FF60B51B000-memory.dmp
            Download

            memory/4672-36-0x00007FF608DD0000-0x00007FF60B51B000-memory.dmp
            Download