Overview

overview

10

Static

static

3

2026-10-02...ch.exe

windows10-2004-x64

7

2026-10-02...ch.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-10-02_fe85fa3547bbaf7995d1ac167b3ce71b_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
  • Size 31.4MB
  • Sample261002-1cln7stdlb
  • SHA256 a7f450085213411bc9ebdab0278d55c0306f236ab04c6019200fb5a2f2596fa3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
xmrigdefense_evasiondiscoveryexecutionminerpersistencespywaretrojan

Malware Config

Targets

    • Target
      2026-10-02_fe85fa3547bbaf7995d1ac167b3ce71b_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
    • Size 31.4MB
    • SHA256 a7f450085213411bc9ebdab0278d55c0306f236ab04c6019200fb5a2f2596fa3
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defense_evasiondiscoveryexecutionpersistencexmrigminerspywaretrojan

    • Family: xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Executes dropped EXE

    • Contacts third-party web service commonly abused for C2

      Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

    • Uses WMI to collect hardware manufacturer information

      Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.

      defense_evasion

    • Discovers running processes

      Running process information can be used to identify security tools or plan follow-on actions.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

Windows Command Shell

1
T1059.003

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Windows Management Instrumentation

1
T1047

Persistence

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Modify Registry

1
T1112

Subvert Trust Controls

2
T1553

Install Root Certificate

2
T1553.004

Virtualization/Sandbox Evasion

1
T1497

System Checks

1
T1497.001

Credential Access

Discovery

Process Discovery

1
T1057

Query Registry

2
T1012

System Information Discovery

1
T1082

System Network Configuration Discovery

1
T1016

Virtualization/Sandbox Evasion

1
T1497

System Checks

1
T1497.001

Lateral Movement

Collection

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Tasks