68738d35a629f423ac46a149672164a29fbe3f104d15a3c8990412a2250ef612

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/09/2026, 17:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_b8da660a9632a2e4b4877ddf11c64a73_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 6.2MB
Sample260929-we15fssyd1
SHA256 68738d35a629f423ac46a149672164a29fbe3f104d15a3c8990412a2250ef612
MD5 b8da660a9632a2e4b4877ddf11c64a73
SHA1 f374fedf598a988049d06bb0f79c83e9c6fead75
SHA512 8ddd9dacbfddd32c41ac444ad0e911cf988baf8c26ed7d5ea1d15562cd97da4dd5022b98f6722c46cf0789783244c99fab55afe3eb72fe3de0eb74958073357b
SSDEEP 49152:87vURVlRWHfsHFGNYh4NXY/PXjO6j6Wh+uHQMeYTQiYA04xBzEGOuJKQK1K6fElh:87cTlUL+eYmw6cDQNivO9EjGa
TLSH
T13B665A07FC9914E9C1AED57489679553BB71BC884B2123D71B90F6382F7ABE0ADB8340
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Sets file to hidden 1 TTPs 4 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1360	attrib.exe
256	attrib.exe
2796	attrib.exe
5848	attrib.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
3720	nssm.exe
2236	node.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\google\data.js	attrib.exe
File opened for modification	C:\Program Files (x86)\google\nssm.exe	attrib.exe
File opened for modification	C:\Program Files (x86)\google\node.exe	attrib.exe
File opened for modification	C:\Program Files (x86)\google\data.js	2026-09-29_b8da660a9632a2e4b4877ddf11c64a73_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
File opened for modification	C:\Program Files (x86)\google\nssm.exe	2026-09-29_b8da660a9632a2e4b4877ddf11c64a73_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
File opened for modification	C:\Program Files (x86)\google\node.exe.tmp	2026-09-29_b8da660a9632a2e4b4877ddf11c64a73_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
File opened for modification	C:\Program Files (x86)\Google	attrib.exe

Launches sc.exe 6 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1192	sc.exe
4516	sc.exe
840	sc.exe
1440	sc.exe
2432	sc.exe
4352	sc.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2564	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-29_b8da660a9632a2e4b4877ddf11c64a73_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-29_b8da660a9632a2e4b4877ddf11c64a73_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	node.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	node.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nssm.exe

Modifies registry key 1 TTPs 5 IoCs

Modify Registry

T1112

pid	Process
4440	reg.exe
5108	reg.exe
3064	reg.exe
4748	reg.exe
4600	reg.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4720 wrote to memory of 1440	4720	2026-09-29_b8da660a9632a2e4b4877ddf11c64a73_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	89
PID 4720 wrote to memory of 2432	4720	2026-09-29_b8da660a9632a2e4b4877ddf11c64a73_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	91
PID 4720 wrote to memory of 4352	4720	2026-09-29_b8da660a9632a2e4b4877ddf11c64a73_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	93
PID 4720 wrote to memory of 1192	4720	2026-09-29_b8da660a9632a2e4b4877ddf11c64a73_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	95
PID 4720 wrote to memory of 4748	4720	2026-09-29_b8da660a9632a2e4b4877ddf11c64a73_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	97
PID 4720 wrote to memory of 4600	4720	2026-09-29_b8da660a9632a2e4b4877ddf11c64a73_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	99
PID 4720 wrote to memory of 4440	4720	2026-09-29_b8da660a9632a2e4b4877ddf11c64a73_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	101
PID 4720 wrote to memory of 5108	4720	2026-09-29_b8da660a9632a2e4b4877ddf11c64a73_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	103
PID 4720 wrote to memory of 3064	4720	2026-09-29_b8da660a9632a2e4b4877ddf11c64a73_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	105
PID 4720 wrote to memory of 4516	4720	2026-09-29_b8da660a9632a2e4b4877ddf11c64a73_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	107
PID 4720 wrote to memory of 840	4720	2026-09-29_b8da660a9632a2e4b4877ddf11c64a73_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	109
PID 4720 wrote to memory of 1360	4720	2026-09-29_b8da660a9632a2e4b4877ddf11c64a73_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	112
PID 4720 wrote to memory of 256	4720	2026-09-29_b8da660a9632a2e4b4877ddf11c64a73_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	114
PID 4720 wrote to memory of 2796	4720	2026-09-29_b8da660a9632a2e4b4877ddf11c64a73_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	116
PID 4720 wrote to memory of 5848	4720	2026-09-29_b8da660a9632a2e4b4877ddf11c64a73_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	118
PID 3720 wrote to memory of 2236	3720	nssm.exe	120
PID 2236 wrote to memory of 2564	2236	node.exe	122

Views/modifies file attributes 1 TTPs 4 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5848	attrib.exe
1360	attrib.exe
256	attrib.exe
2796	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-29_b8da660a9632a2e4b4877ddf11c64a73_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_b8da660a9632a2e4b4877ddf11c64a73_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Windows\system32\sc.exe
  sc.exe stop WinDefSvc
  2⤵
  - Launches sc.exe
  PID:1440
- C:\Windows\system32\sc.exe
  sc.exe delete WinDefSvc
  2⤵
  - Launches sc.exe
  PID:2432
- C:\Windows\system32\sc.exe
  sc.exe create WinDefSvc binPath= "\"C:\Program Files (x86)\google\nssm.exe\"" start= auto
  2⤵
  - Launches sc.exe
  PID:4352
- C:\Windows\system32\sc.exe
  sc.exe query WinDefSvc
  2⤵
  - Launches sc.exe
  PID:1192
- C:\Windows\system32\reg.exe
  reg.exe add HKLM\SYSTEM\CurrentControlSet\Services\WinDefSvc\Parameters /v Application /t REG_EXPAND_SZ /d "C:\Program Files (x86)\google\node.exe" /f
  2⤵
  - Modifies registry key
  PID:4748
- C:\Windows\system32\reg.exe
  reg.exe add HKLM\SYSTEM\CurrentControlSet\Services\WinDefSvc\Parameters /v AppParameters /t REG_EXPAND_SZ /d "\"C:\Program Files (x86)\google\data.js\"" /f
  2⤵
  - Modifies registry key
  PID:4600
- C:\Windows\system32\reg.exe
  reg.exe add HKLM\SYSTEM\CurrentControlSet\Services\WinDefSvc\Parameters /v AppDirectory /t REG_EXPAND_SZ /d "C:\Program Files (x86)\google" /f
  2⤵
  - Modifies registry key
  PID:4440
- C:\Windows\system32\reg.exe
  reg.exe add HKLM\SYSTEM\CurrentControlSet\Services\WinDefSvc\Parameters /v AppRestartDelay /t REG_DWORD /d 5000 /f
  2⤵
  - Modifies registry key
  PID:5108
- C:\Windows\system32\reg.exe
  reg.exe add HKLM\SYSTEM\CurrentControlSet\Services\WinDefSvc\Parameters /v AppNoConsole /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:3064
- C:\Windows\system32\sc.exe
  sc.exe description WinDefSvc "Windows Defender Service Helper"
  2⤵
  - Launches sc.exe
  PID:4516
- C:\Windows\system32\sc.exe
  sc.exe start WinDefSvc
  2⤵
  - Launches sc.exe
  PID:840
- C:\Windows\system32\attrib.exe
  attrib.exe +s +h "C:\Program Files (x86)\google"
  2⤵
  - Sets file to hidden
  - Drops file in Program Files directory
  - Views/modifies file attributes
  PID:1360
- C:\Windows\system32\attrib.exe
  attrib.exe +s +h "C:\Program Files (x86)\google\data.js"
  2⤵
  - Sets file to hidden
  - Drops file in Program Files directory
  - Views/modifies file attributes
  PID:256
- C:\Windows\system32\attrib.exe
  attrib.exe +s +h "C:\Program Files (x86)\google\nssm.exe"
  2⤵
  - Sets file to hidden
  - Drops file in Program Files directory
  - Views/modifies file attributes
  PID:2796
- C:\Windows\system32\attrib.exe
  attrib.exe +s +h "C:\Program Files (x86)\google\node.exe"
  2⤵
  - Sets file to hidden
  - Drops file in Program Files directory
  - Views/modifies file attributes
  PID:5848

C:\Program Files (x86)\google\nssm.exe
"C:\Program Files (x86)\google\nssm.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3720
- C:\Program Files (x86)\google\node.exe
  "C:\Program Files (x86)\google\node.exe" "C:\Program Files (x86)\google\data.js"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of WriteProcessMemory
  PID:2236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "vol C:"
    3⤵
    - Executes a command shell one-liner
    PID:2564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

nssm.exe

Path C:\Program Files (x86)\Google\nssm.exe
Size 288KB
SHA256 472232ca821b5c2ef562ab07f53638bc2cc82eae84cea13fbe674d6022b6481c
MD5 d9ec6f3a3b2ac7cd5eef07bd86e3efbc
SHA1 e1908caab6f938404af85a7df0f80f877a4d9ee6
SHA512 1b6b8702dca3cb90fe64c4e48f2477045900c5e71dd96b84f673478bab1089febfa186bfc55aebd721ca73db1669145280ebb4e1862d3b9dc21f712cd76a07c4
SSDEEP 6144:4BULviqYnI3QA7JTXRnZSHL2GZbkG/TZgLgst2rDkXNBD:wqBlG/TZgUsxXNBD
TLSH
T16954605263ED8A61F5F73F71683946210F36BCA19E3CC14E5390992E2CB1AA4DC747A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.js

Path C:\Program Files (x86)\google\data.js
Size 27KB
SHA256 d3d06389f4d53058c653797312a59a58b5d8337489d822b8cf92a238e69b4fa6
MD5 0354746946be0a9a2e5c953a52367a1d
SHA1 280bcf7ac0a68a57a59a449db035a3adb1f4efb1
SHA512 c2afc18ff43ebdc97aa6cef033b2714cc5c2693c88e16aee50e68c61f21550dd76e557c3909de9c00318beee3d881ca91d1e0878c31fd8b4ad21fc86a4e169e9
SSDEEP 768:vSGim9+RxSGsFyVDCfp8eOPf7bFJ7jGEDXuSPeS8H5sZIBs0SsN+sKszsqhfW4nN:Wz6SWPFIlObvORbm
TLSH
T1EAD2A3003FD42192338B8FE7B71BA0DAE14B051AF69148CBE2197E546D5A276EFD1E31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads