Overview

overview

5

Static

static

3

2026-10-16...ch.exe

windows10-2004-x64

5

2026-10-16...ch.exe

windows11-ltsc_2024-x64

5

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    17/10/2026, 22:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-16_1d0aa1d15808f2966303ca08f0cd7998_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  • Size 6.4MB
  • Sample261017-2bbnaaet5v
  • SHA256 d39cd98afbf121306cbc6842ca9da792dfe762acbf960f710804bec38b2b66ee
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
defense_evasiondiscoveryexecutionspywaretrojan

Malware Config

Signatures

  • Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Modifies registry class 1 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
    defense_evasionspywaretrojan
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-16_1d0aa1d15808f2966303ca08f0cd7998_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-16_1d0aa1d15808f2966303ca08f0cd7998_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
    1⤵
    • Reads the TCP/IP host and domain name from the registry
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:2620
    • C:\Windows\System32\wscript.exe
      C:\Windows\System32\wscript.exe /NoLogo C:\Users\Admin\AppData\Local\PanFast\pf_1792275934692886800.vbs
      2⤵
      • Executes a VBScript file via the Windows Script Host.
      PID:4404
    • C:\Windows\explorer.exe
      /select,"C:\Users\Admin\Desktop\极速下载好的文件\brhdlxnvzdxs.rar.lz4"
      2⤵
      • Modifies registry class
      PID:5164
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:4880

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          5CD7E13B2960BFF6757B2C97FDA2D03F
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5CD7E13B2960BFF6757B2C97FDA2D03F
          • Size 947B
          • SHA256 4348a0e9444c78cb265e058d5e8944b4d84f9662bd26db257f8934a443c70161
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          77EC63BDA74BD0D0E0426DC8F8008506
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
          • Size 78KB
          • SHA256 778412b81d2d1b42a8394bd7920506224afb565e1159933f7366fed1fcc7891c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          5CD7E13B2960BFF6757B2C97FDA2D03F
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5CD7E13B2960BFF6757B2C97FDA2D03F
          • Size 250B
          • SHA256 3a27f1f25471de626a0805b3b5901414a5814ee01b092bda76cc9e0a9da97537
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          pf_1792275934692886800.vbs
          • Path C:\Users\Admin\AppData\Local\PanFast\pf_1792275934692886800.vbs
          • Size 810B
          • SHA256 f430889fc290604656e68557b1aa299c8f1c85c6a985dc9cb0d8cbad74e3ff64
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          pf_r1792275934692886800.txt
          • Path C:\Users\Admin\AppData\Local\Temp\pf_r1792275934692886800.txt
          • Size 8B
          • SHA256 d46d3c1e633bd00e63abb863f8d0ce01127a4aef5135d7a4add02e126cd4d912
          • MD5 SHA1 SHA512
          Submit Download