Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/09/2026, 00:10
Static task
static1
3 signatures
General
- Target 2026-09-29_5ce441a8c7df0ac6923fb2c4882356ca_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
- Size 8.8MB
- Sample260930-af9bkaab38
- SHA256 aaea58096313c877495ab0c07de3217cefdf1bc9bd9d08df06b44881fe9b90a9
- MD5 5ce441a8c7df0ac6923fb2c4882356ca
- SHA1 018880863abf8004eb7e25f2258466b274c1220d
- SHA512 e2cd5bf30b8b2b9ad33ae4bc0448d68ae44f8c5e713747200518cd69818ef3c2a811403832cf733cd08f7c1443eea142c457f4d057ad79852be2b94097c72ae7
- SSDEEP 98304:gdveRnC5yE/Xcha3agODfh00MHCN+35blJzHRlCEo2lQsAhEU:Mz5yeXc6juf5AAi
- TLSH T11D962743EDA518E4C1AEC2748672A152BB717C895F3123E72B50F6246F37BD0AEB9710
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
ioc Process \??\F:\ powershell.exe -
pid Process 1636 powershell.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3176 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 2026-09-29_5ce441a8c7df0ac6923fb2c4882356ca_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 2026-09-29_5ce441a8c7df0ac6923fb2c4882356ca_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe - Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 4208 ipconfig.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4792 2026-09-29_5ce441a8c7df0ac6923fb2c4882356ca_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 4792 2026-09-29_5ce441a8c7df0ac6923fb2c4882356ca_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 4792 2026-09-29_5ce441a8c7df0ac6923fb2c4882356ca_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 4792 2026-09-29_5ce441a8c7df0ac6923fb2c4882356ca_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 1636 powershell.exe 1636 powershell.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1344 wmic.exe Token: SeSecurityPrivilege 1344 wmic.exe Token: SeTakeOwnershipPrivilege 1344 wmic.exe Token: SeLoadDriverPrivilege 1344 wmic.exe Token: SeSystemProfilePrivilege 1344 wmic.exe Token: SeSystemtimePrivilege 1344 wmic.exe Token: SeProfSingleProcessPrivilege 1344 wmic.exe Token: SeIncBasePriorityPrivilege 1344 wmic.exe Token: SeCreatePagefilePrivilege 1344 wmic.exe Token: SeBackupPrivilege 1344 wmic.exe Token: SeRestorePrivilege 1344 wmic.exe Token: SeShutdownPrivilege 1344 wmic.exe Token: SeDebugPrivilege 1344 wmic.exe Token: SeSystemEnvironmentPrivilege 1344 wmic.exe Token: SeRemoteShutdownPrivilege 1344 wmic.exe Token: SeUndockPrivilege 1344 wmic.exe Token: SeManageVolumePrivilege 1344 wmic.exe Token: 33 1344 wmic.exe Token: 34 1344 wmic.exe Token: 35 1344 wmic.exe Token: 36 1344 wmic.exe Token: SeIncreaseQuotaPrivilege 1344 wmic.exe Token: SeSecurityPrivilege 1344 wmic.exe Token: SeTakeOwnershipPrivilege 1344 wmic.exe Token: SeLoadDriverPrivilege 1344 wmic.exe Token: SeSystemProfilePrivilege 1344 wmic.exe Token: SeSystemtimePrivilege 1344 wmic.exe Token: SeProfSingleProcessPrivilege 1344 wmic.exe Token: SeIncBasePriorityPrivilege 1344 wmic.exe Token: SeCreatePagefilePrivilege 1344 wmic.exe Token: SeBackupPrivilege 1344 wmic.exe Token: SeRestorePrivilege 1344 wmic.exe Token: SeShutdownPrivilege 1344 wmic.exe Token: SeDebugPrivilege 1344 wmic.exe Token: SeSystemEnvironmentPrivilege 1344 wmic.exe Token: SeRemoteShutdownPrivilege 1344 wmic.exe Token: SeUndockPrivilege 1344 wmic.exe Token: SeManageVolumePrivilege 1344 wmic.exe Token: 33 1344 wmic.exe Token: 34 1344 wmic.exe Token: 35 1344 wmic.exe Token: 36 1344 wmic.exe Token: SeDebugPrivilege 1636 powershell.exe Token: SeIncreaseQuotaPrivilege 1636 powershell.exe Token: SeSecurityPrivilege 1636 powershell.exe Token: SeTakeOwnershipPrivilege 1636 powershell.exe Token: SeLoadDriverPrivilege 1636 powershell.exe Token: SeSystemProfilePrivilege 1636 powershell.exe Token: SeSystemtimePrivilege 1636 powershell.exe Token: SeProfSingleProcessPrivilege 1636 powershell.exe Token: SeIncBasePriorityPrivilege 1636 powershell.exe Token: SeCreatePagefilePrivilege 1636 powershell.exe Token: SeBackupPrivilege 1636 powershell.exe Token: SeRestorePrivilege 1636 powershell.exe Token: SeShutdownPrivilege 1636 powershell.exe Token: SeDebugPrivilege 1636 powershell.exe Token: SeSystemEnvironmentPrivilege 1636 powershell.exe Token: SeRemoteShutdownPrivilege 1636 powershell.exe Token: SeUndockPrivilege 1636 powershell.exe Token: SeManageVolumePrivilege 1636 powershell.exe Token: 33 1636 powershell.exe Token: 34 1636 powershell.exe Token: 35 1636 powershell.exe Token: 36 1636 powershell.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4792 wrote to memory of 3176 4792 2026-09-29_5ce441a8c7df0ac6923fb2c4882356ca_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 85 PID 4792 wrote to memory of 4208 4792 2026-09-29_5ce441a8c7df0ac6923fb2c4882356ca_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 87 PID 4792 wrote to memory of 1344 4792 2026-09-29_5ce441a8c7df0ac6923fb2c4882356ca_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 89 PID 4792 wrote to memory of 1636 4792 2026-09-29_5ce441a8c7df0ac6923fb2c4882356ca_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_5ce441a8c7df0ac6923fb2c4882356ca_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_5ce441a8c7df0ac6923fb2c4882356ca_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Windows\system32\cmd.execmd /c ver2⤵
- Executes a command shell one-liner
PID:3176
-
-
C:\Windows\system32\ipconfig.exeipconfig /all2⤵
- Gathers network information
PID:4208
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get vendor,Name2⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:1344
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -NonInteractive -Command "[int](Get-Date).Subtract((Get-CimInstance Win32_OperatingSystem).LastBootUpTime).TotalSeconds"2⤵
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1636
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0umrfazd.zhi.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH