Analysis
- max time kernel
148s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/09/2026, 01:01
Behavioral task
behavioral1
Sample
2026-09-09_035a4116996edfa53585508159248e8d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
General
- Target 2026-09-09_035a4116996edfa53585508159248e8d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
- Size 10.2MB
- Sample260910-bdngrack9y
- SHA256 44a6a68dca84d8a7227d350cd5cde46468a865eb439ccf73ab1c93fd172f8ee0
- MD5 035a4116996edfa53585508159248e8d
- SHA1 c8e11fd7520c33770c418f546d8f5bf334dd9790
- SHA512 26952e0fc5191545ba06c1ca95af646298e6bf979aaed95ac99a51a259a6506da43da5e4fa13670a99639a9ba448138ad0501ed1e468e741fba4365f2b18b35a
- SSDEEP 98304:rJ9YeGMgzvIfjeAICblG7lwqf3G/yMWEcv:L1GlvKjh7mGyMTcv
- TLSH T1D3B65B47EC6515E9C0ADD2368566A113BF717C494B2223E71B60F6382F37BD0AEBA350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 3468 2026-09-09_035a4116996edfa53585508159248e8d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe Token: SeDebugPrivilege 3468 2026-09-09_035a4116996edfa53585508159248e8d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3468 wrote to memory of 3488 3468 2026-09-09_035a4116996edfa53585508159248e8d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-09_035a4116996edfa53585508159248e8d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-09_035a4116996edfa53585508159248e8d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Windows\system32\cmd.execmd ver2⤵PID:3488
-