a204273a5334f1619bae9e174dea0fb4f8a2452f9e93271182e1fc4577d522be

Analysis

max time kernel
148s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 23:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-25_81621636ab9f35a2881cf51cc8f42095_coinminer_dosia_eternalromance_glassworm_malwareactor_om.exe
Size 20.5MB
Sample260925-3tapdassat
SHA256 a204273a5334f1619bae9e174dea0fb4f8a2452f9e93271182e1fc4577d522be
MD5 81621636ab9f35a2881cf51cc8f42095
SHA1 7b624703a8300dcdee2fecd070f7bb86cf07c57e
SHA512 3ca90f20bf57f94f33e2d10008fb7fd043e944145465308c85ae143d0f5cfcf007d93235737184e93af6f51135cefa1d047f4f40b1c85da21b7124cf65426ef4
SSDEEP 196608:Ex3NsYvExUBNixthoxLKqGSh3brqM+UjI0sLo+xMmvWL/C4msoLzmZhxnMgq/:DeICN2hLYdQVMmvWvmrm/xMge
TLSH
T1B2278C07E86516E9C0ADD271C5769213BA717C8A5B3223D71FA0F6202FB3BD0ADB9714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Reads the TCP/IP host and domain name from the registry 1 TTPs 1 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-25_81621636ab9f35a2881cf51cc8f42095_coinminer_dosia_eternalromance_glassworm_malwareactor_om.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5052 wrote to memory of 4828	5052	2026-09-25_81621636ab9f35a2881cf51cc8f42095_coinminer_dosia_eternalromance_glassworm_malwareactor_om.exe	86
PID 5052 wrote to memory of 4112	5052	2026-09-25_81621636ab9f35a2881cf51cc8f42095_coinminer_dosia_eternalromance_glassworm_malwareactor_om.exe	88
PID 5052 wrote to memory of 4644	5052	2026-09-25_81621636ab9f35a2881cf51cc8f42095_coinminer_dosia_eternalromance_glassworm_malwareactor_om.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-09-25_81621636ab9f35a2881cf51cc8f42095_coinminer_dosia_eternalromance_glassworm_malwareactor_om.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-25_81621636ab9f35a2881cf51cc8f42095_coinminer_dosia_eternalromance_glassworm_malwareactor_om.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:5052
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\2026-09-25_81621636ab9f35a2881cf51cc8f42095_coinminer_dosia_eternalromance_glassworm_malwareactor_om.exe" /v Debugger
  2⤵
  PID:4828
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" /v AppInit_DLLs
  2⤵
  PID:4112
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" /v LoadAppInit_DLLs
  2⤵
  PID:4644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.statekey

Path C:\Users\Admin\.cache\dataplane\.statekey
Size 32B
SHA256 ab678fe38bb453e248dc00e0e23b517ac398e1184b6503c39fdde377246e38be
MD5 f55a53dea60ca4565fd99bf9285efcb0
SHA1 b4c9ba2828ba786a068f8324cfc331154679e708
SHA512 b0807bed2c3c099723ef5c30af5f4d271cb3fc3db2dccf6ec1eb33dd135cefd65057415a3a0d96bfd5ac66ff8198e83c7973f8aeb3db6512e3c966c16aa55d4d
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\.integrity\manifest.json
Size 348B
SHA256 fa75e34025aa22ff672be559bc7f1fa4e26197b2478eccb97041c9882e8ec25f
MD5 863e42391ec29cddd9656932f4f41dce
SHA1 948ae2f0d41cc508bf8f9114bccf15a0f5e8b298
SHA512 e43a423952b821bc12a378bb65e50f3fb8a17145e14640138d96eb794c8f8950b70893f4a65aa793cacff037a2f872e21745a66bd4c910dd4847a86bd5d53f35
TLSH
T1C6E0C0221D986BEC7751C50A91615E7B8C3D59CED46D479243EC8CDD5EC20DF2137016
MD5 SHA1 SHA512 TLSH