a8e73c9c3d8ca1d28f3019c674a58a04eac734cb59a3bd98cfe6c5dfa49071bc

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/10/2026, 10:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-02_721032254c16f02fe968900c89850326_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 7.2MB
Sample261003-mb5h2axyex
SHA256 a8e73c9c3d8ca1d28f3019c674a58a04eac734cb59a3bd98cfe6c5dfa49071bc
MD5 721032254c16f02fe968900c89850326
SHA1 bb6b5aa5cf1bb8ac42a7a7d82b1e13de01ca893f
SHA512 22904ae17715d705dd178073def943695150d3ae536b382faaecbd375db37778bc4766df1f6af6d417aab3a4afe2515c633d510373bc13703c2e4341744e665c
SSDEEP 98304:PFOaZxYsVNpaERKq4Fak8rumvBh8huTPEAzZz3:Pj7YsrAwudA1r
TLSH
T1EF765A07EC9515E9C0FE95348A639622BB617C484B3163D32F60F6352F76BE0ADBA344
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
9	3428	2026-10-02_721032254c16f02fe968900c89850326_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
5816	2026-10-02_721032254c16f02fe968900c89850326_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

Executes dropped EXE 1 IoCs

pid	Process
5816	2026-10-02_721032254c16f02fe968900c89850326_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-02_721032254c16f02fe968900c89850326_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-02_721032254c16f02fe968900c89850326_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-02_721032254c16f02fe968900c89850326_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-02_721032254c16f02fe968900c89850326_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3428	2026-10-02_721032254c16f02fe968900c89850326_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3428 wrote to memory of 5816	3428	2026-10-02_721032254c16f02fe968900c89850326_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-10-02_721032254c16f02fe968900c89850326_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-02_721032254c16f02fe968900c89850326_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Downloads MZ/PE file
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3428
- C:\Users\Admin\AppData\Local\Temp\2026-10-02_721032254c16f02fe968900c89850326_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-10-02_721032254c16f02fe968900c89850326_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  PID:5816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-10-02_721032254c16f02fe968900c89850326_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-10-02_721032254c16f02fe968900c89850326_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 7.2MB
SHA256 2526965d540d1d4e06dc168ab5b6d004c920105d28e68c46cfc7d699e1b18e08
MD5 851d34bc67a6d8e75c2997d3d56f6614
SHA1 f73c41a1b6789670d1d4a05559547d4618e7ecae
SHA512 c9894daece9c2780ec34faf5affc93b00cec189d9182a6d7026a240be5620c68cc4c2a9f11f0940573b3f913335af5c015896181625c78419a58ab715be01254
SSDEEP 98304:9e5bMCFbhobPoKVD48JuOvBhdhuTlECQzZzZ:shMjVdCQ19
TLSH
T138765907EC9565E8C0BE95348A729223BF217C484B3123D72B50F6642F7ABE0BE79754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3428-6-0x00007FF6FDFA0000-0x00007FF70072D000-memory.dmp

Download