50c3eddf1b644f43d62cea5584c62461ea6b35d3afb898e7890faad85b5d2b5d

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/09/2026, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-26_ac2b7f9b8efcb079fc9570ecd68b3abe_coinminer_dosia_elex_glassworm_poet-rat_quasar-rat_sliver_snatch.exe
Size 47.4MB
Sample260926-vb2fdayvh1
SHA256 50c3eddf1b644f43d62cea5584c62461ea6b35d3afb898e7890faad85b5d2b5d
MD5 ac2b7f9b8efcb079fc9570ecd68b3abe
SHA1 60fc9d3920428aaa8031bb1d8c38dca162218058
SHA512 2f337897bf64820c846b07b1d77f680ab43f0ebe1ac1f015cfd5f1645fac602c7d73b76fd6aee60945bed0354de009e8426301f02a3030968d883b9e6517e4ef
SSDEEP 196608:7kxZxbNckcYaYzup2fInxPkBhgbnHd1X4VfBdUVAY5hLFUi9B2SMXBoWncljdPuX:7YptPak87nX4VJmLN9B/JM+jZ5bHOYuV
TLSH
T119B75A25F9C745F5E9070C30419BB26F3B349D038724DA9BFA59BE59EE37692083B206
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Reads the TCP/IP host and domain name from the registry 1 TTPs 1 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-26_ac2b7f9b8efcb079fc9570ecd68b3abe_coinminer_dosia_elex_glassworm_poet-rat_quasar-rat_sliver_snatch.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4668	2026-09-26_ac2b7f9b8efcb079fc9570ecd68b3abe_coinminer_dosia_elex_glassworm_poet-rat_quasar-rat_sliver_snatch.exe
4668	2026-09-26_ac2b7f9b8efcb079fc9570ecd68b3abe_coinminer_dosia_elex_glassworm_poet-rat_quasar-rat_sliver_snatch.exe
4668	2026-09-26_ac2b7f9b8efcb079fc9570ecd68b3abe_coinminer_dosia_elex_glassworm_poet-rat_quasar-rat_sliver_snatch.exe
4668	2026-09-26_ac2b7f9b8efcb079fc9570ecd68b3abe_coinminer_dosia_elex_glassworm_poet-rat_quasar-rat_sliver_snatch.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-26_ac2b7f9b8efcb079fc9570ecd68b3abe_coinminer_dosia_elex_glassworm_poet-rat_quasar-rat_sliver_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-26_ac2b7f9b8efcb079fc9570ecd68b3abe_coinminer_dosia_elex_glassworm_poet-rat_quasar-rat_sliver_snatch.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:4668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads