Analysis

  • max time kernel
    149s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    23/10/2026, 10:06

General

  • Target
    2026-10-23_86854899b8577e9ee85ae577e0df269e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  • Size 9.2MB
  • Sample261023-l5bblscf32
  • SHA256 8f7f1a7ae0fbc224824bdbd0770ea7ac918a85e2937c4e7aa2f781544256623d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10

Malware Config

Signatures

  • Discovers running processes 1 TTPs 4 IoCs

    Running process information can be used to identify security tools or plan follow-on actions.

  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-23_86854899b8577e9ee85ae577e0df269e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-23_86854899b8577e9ee85ae577e0df269e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1880
    • C:\Users\Admin\AppData\Local\Temp\2026-10-23_86854899b8577e9ee85ae577e0df269e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2026-10-23_86854899b8577e9ee85ae577e0df269e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -test.run=TestProcesoFalso -- 51528
      2⤵
        PID:924
      • C:\Users\Admin\AppData\Local\Temp\2026-10-23_86854899b8577e9ee85ae577e0df269e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        C:\Users\Admin\AppData\Local\Temp\2026-10-23_86854899b8577e9ee85ae577e0df269e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -test.run=TestProcesoFalso -- 51534
        2⤵
          PID:1356
        • C:\Windows\system32\tasklist.exe
          tasklist /FI "PID eq 924" /NH
          2⤵
          • Discovers running processes
          • Suspicious use of AdjustPrivilegeToken
          PID:972
        • C:\Windows\system32\tasklist.exe
          tasklist /FI "PID eq 924" /NH
          2⤵
          • Discovers running processes
          • Suspicious use of AdjustPrivilegeToken
          PID:4836
        • C:\Windows\system32\tasklist.exe
          tasklist /FI "PID eq 1356" /NH
          2⤵
          • Discovers running processes
          • Suspicious use of AdjustPrivilegeToken
          PID:1616
        • C:\Windows\system32\tasklist.exe
          tasklist /FI "PID eq 1356" /NH
          2⤵
          • Discovers running processes
          • Suspicious use of AdjustPrivilegeToken
          PID:2312
        • C:\Users\Admin\AppData\Local\Temp\2026-10-23_86854899b8577e9ee85ae577e0df269e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
          C:\Users\Admin\AppData\Local\Temp\2026-10-23_86854899b8577e9ee85ae577e0df269e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -test.run=TestProcesoFalso -- 51540
          2⤵
            PID:1168
          • C:\Users\Admin\AppData\Local\Temp\2026-10-23_86854899b8577e9ee85ae577e0df269e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
            C:\Users\Admin\AppData\Local\Temp\2026-10-23_86854899b8577e9ee85ae577e0df269e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -test.run=TestProcesoFalso -- 51543
            2⤵
              PID:1104
            • C:\Users\Admin\AppData\Local\Temp\2026-10-23_86854899b8577e9ee85ae577e0df269e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
              C:\Users\Admin\AppData\Local\Temp\2026-10-23_86854899b8577e9ee85ae577e0df269e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -test.run=NoExisteEsteTest
              2⤵
                PID:2520
              • C:\Users\Admin\AppData\Local\Temp\2026-10-23_86854899b8577e9ee85ae577e0df269e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
                C:\Users\Admin\AppData\Local\Temp\2026-10-23_86854899b8577e9ee85ae577e0df269e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -test.run=TestProcesoFalso -- 51587 http:///revisar/ C:\Users\Admin\AppData\Local\Temp\TestApiReplayAbreYCierra1641743758\001\gt\game-test_gt_borrador.csv
                2⤵
                  PID:3212

              Network

                    MITRE ATT&CK Enterprise v16

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    config.yaml

                    • Path C:\Users\Admin\AppData\Local\Temp\TestApiReplayAbreYCierra1641743758\001\config.yaml
                    • Size 936B
                    • SHA256 3c6d1ff040967f3c979d54510b7a2dfe3de28f08f802f16fafef64992f08e169
                    • MD5 SHA1 SHA512 TLSH

                    game-test_bases_ref.jpg

                    • Path C:\Users\Admin\AppData\Local\Temp\TestApiReplayAbreYCierra1641743758\001\videos\game-test_bases_ref.jpg
                    • Size 8B
                    • SHA256 3974fc53fcaa9281ca0f47474befa8f5edba9ae7740f8b7ec66e1bd3e3aa6f38
                    • MD5 SHA1 SHA512

                    config.yaml

                    • Path C:\Users\Admin\AppData\Local\Temp\TestArgsReplayYImportacionDelGT2338182604\001\config.yaml
                    • Size 964B
                    • SHA256 8fbabb2c2c31aeb7b84cc7322ad6f823391cd66db8583fe099d7771e93774611
                    • MD5 SHA1 SHA512 TLSH

                    jugadas_raw.jsonl

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselineAgregadoSumaYNoPromedia4224458711\001\OutputFullAnalyzer\game-singt\vivo\20261101_130000_sol\lvm\jugadas_raw.jsonl
                    • Size 588B
                    • SHA256 c5774255b14cd19b0af41a146048066c9814b3bbab5ebbc65451447f6643f1bf
                    • MD5 SHA1 SHA512 TLSH

                    config.yaml

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselineAgregadoSumaYNoPromedia4224458711\001\config.yaml
                    • Size 1KB
                    • SHA256 14ede7af0a1aef1c2a2db8a454e3099bde72e28fa596376f658e9de467f89e57
                    • MD5 SHA1 SHA512 TLSH

                    ecf825dc6480bb51f3c3658e58a3f9c461bb2408.json

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselineCacheYHuella2591870466\001\cache\baseline\ecf825dc6480bb51f3c3658e58a3f9c461bb2408.json
                    • Size 6KB
                    • SHA256 9aebbf71bc96975f77b70aa8b17af219c10aa70f8803acecc85bbf87a1b60ab8
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    config.yaml

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselineCacheYHuella2591870466\001\config.yaml
                    • Size 1KB
                    • SHA256 59da2eabfdb3e844b1b27ac7f474e3058267c4292f9fd73fe63908936411acec
                    • MD5 SHA1 SHA512 TLSH

                    config.yaml

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselineGTDeUnCSVElegidoYSelector4034596556\001\config.yaml
                    • Size 1KB
                    • SHA256 df9da189bb34ef186ce5c3e378aa2e6c54c064e333421f18ed90299e81b0d069
                    • MD5 SHA1 SHA512 TLSH

                    jugadas_raw.jsonl

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselineNoEscribeFueraDeLaCache2756140134\001\OutputFullAnalyzer\game-bl2\vivo\20261101_110000_sol\lvm\jugadas_raw.jsonl
                    • Size 578B
                    • SHA256 88084e81b7b3f646ad663522fb6a13fe6ad0992ec4cdafa4058a6cc7e70a5d1f
                    • MD5 SHA1 SHA512 TLSH

                    hechos.jsonl

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselineNoEscribeFueraDeLaCache2756140134\001\OutputFullAnalyzer\game-bl\vivo\20261102_100000_sim\hechos.jsonl
                    • Size 1KB
                    • SHA256 80b696e5369eba5b2421dc54eb0090e018d72b52ff1c386d80c8d2389c3d21aa
                    • MD5 SHA1 SHA512 TLSH

                    config.yaml

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselineNoEscribeFueraDeLaCache2756140134\001\config.yaml
                    • Size 1KB
                    • SHA256 e3be375c69a31eb7f65e2970db917c9b8981169a178b929af2f749ecfdca82fa
                    • MD5 SHA1 SHA512 TLSH

                    game-sincsv_gt_borrador.csv

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselineNoEscribeFueraDeLaCache2756140134\001\gt\game-sincsv_gt_borrador.csv
                    • Size 34B
                    • SHA256 b861a8c0289c4af8f00bafe6f9830c1647e00854afdc66dec45e39bab2fefd94
                    • MD5 SHA1 SHA512

                    game-bl2.mov

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselineNoEscribeFueraDeLaCache2756140134\001\videos\game-bl2.mov
                    • Size 10B
                    • SHA256 870391cb8b7042f102d6d2459264e1de02d3bf15d8bb5840cf1aae4e8cb52943
                    • MD5 SHA1 SHA512

                    config.yaml

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselinePaginasYPartidos2674843898\001\config.yaml
                    • Size 1KB
                    • SHA256 99ca25e41ef25672dfeddeaed8c534fbd3d1ff33fbf5c3d50f2bc8e41f5bfc01
                    • MD5 SHA1 SHA512 TLSH

                    config.yaml

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselineSeguridad134490262\001\config.yaml
                    • Size 1014B
                    • SHA256 d8813a710cf6c5d35965151474380437f4f9bef4a3dcbae9be192c4445c2125e
                    • MD5 SHA1 SHA512 TLSH

                    jugadas_raw.jsonl

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselineSinCSVoSinGTEsSinDatosYNoCero4236606076\001\OutputFullAnalyzer\game-bl\vivo\20261102_100000_sim\lvm\jugadas_raw.jsonl
                    • Size 590B
                    • SHA256 06bf10ba895e33c60fd0d4f07f849665ac3f567762342e15336f6df07129f7a0
                    • MD5 SHA1 SHA512 TLSH

                    jugadas_raw.jsonl

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselineSinCSVoSinGTEsSinDatosYNoCero4236606076\001\OutputFullAnalyzer\game-sincsv\vivo\20261101_120000_sol\lvm\jugadas_raw.jsonl
                    • Size 593B
                    • SHA256 7d465a485e3671a3e58d411a9e8c1343159e23082c4d2df6ddec5179145208c5
                    • MD5 SHA1 SHA512 TLSH

                    pitch-results-game-bl2.csv

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselineSinCSVoSinGTEsSinDatosYNoCero4236606076\001\baselines\pitch-results-game-bl2.csv
                    • Size 148B
                    • SHA256 7f58338abff4bb4ad7c202a1609d4cce0d87c9e02e7cf9ae4bfcf994474f7aa4
                    • MD5 SHA1 SHA512 TLSH

                    config.yaml

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselineSinCSVoSinGTEsSinDatosYNoCero4236606076\001\config.yaml
                    • Size 1KB
                    • SHA256 17c650de1361e730c48c14e15174c1eba0b9b3731712d8580755ab2a08b88b4a
                    • MD5 SHA1 SHA512 TLSH

                    gt_revision.jsonl

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselineUnPartidoSintetico807835538\001\OutputFullAnalyzer\game-bl\vivo\20261101_100000_sol\gt\gt_revision.jsonl
                    • Size 550B
                    • SHA256 42a27373db640f4a452d37d0f582f92bcbe27d57616cfa8e8775e10db86e18cc
                    • MD5 SHA1 SHA512 TLSH

                    jugadas_raw.jsonl

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselineUnPartidoSintetico807835538\001\OutputFullAnalyzer\game-bl\vivo\20261101_100000_sol\lvm\jugadas_raw.jsonl
                    • Size 573B
                    • SHA256 0cd1d21fabc7c28aeecc044bfe9115c5542c7921097c4903d5ff7546b5e54900
                    • MD5 SHA1 SHA512 TLSH

                    config.json

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselineUnPartidoSintetico807835538\001\OutputFullAnalyzer\game-bl\vivo\20261102_100000_sim\config.json
                    • Size 84B
                    • SHA256 9154cf6959718b96567857e8565cc66ff0d0ada9e6f8b7157d48897dc38bb31c
                    • MD5 SHA1 SHA512 TLSH

                    events_manifest.jsonl

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselineUnPartidoSintetico807835538\001\OutputFullAnalyzer\game-sincsv\vivo\20261101_120000_sol\captura\game-sincsv\events_manifest.jsonl
                    • Size 380B
                    • SHA256 a0624193557e6272ff145ca9c647a59b7b3d91af2ae8e0c837a20cf181c95f18
                    • MD5 SHA1 SHA512 TLSH

                    medicion.json

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselineUnPartidoSintetico807835538\001\OutputFullAnalyzer\game-sincsv\vivo\20261101_120000_sol\medicion.json
                    • Size 52B
                    • SHA256 2dfcd907fe8b3b8d2e72b37159199c82d7012ddb5ec1bed6d427c8e9abb8501f
                    • MD5 SHA1 SHA512 TLSH

                    config.json

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselineUnPartidoSintetico807835538\001\OutputFullAnalyzer\game-singt\vivo\20261101_130000_sol\config.json
                    • Size 79B
                    • SHA256 1376ac79f161b8137b6f6dbe8c311486190467b01303ac06806400508dbbee79
                    • MD5 SHA1 SHA512 TLSH

                    hechos.jsonl

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselineUnPartidoSintetico807835538\001\OutputFullAnalyzer\game-singt\vivo\20261101_130000_sol\hechos.jsonl
                    • Size 1KB
                    • SHA256 67134db10221d146175f3704577007e09778363c9f14342283a04ffdea07dfb8
                    • MD5 SHA1 SHA512 TLSH

                    pitch-results-bl.csv

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselineUnPartidoSintetico807835538\001\baselines\pitch-results-bl.csv
                    • Size 330B
                    • SHA256 27494149175673306282517be82d588f67211dd008c4e63b0de909d3b398d42a
                    • MD5 SHA1 SHA512 TLSH

                    config.yaml

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselineUnPartidoSintetico807835538\001\config.yaml
                    • Size 1KB
                    • SHA256 31d9f37cf935938682f98e46e9722fd901c661693a838eb48dc075751dbdc667
                    • MD5 SHA1 SHA512 TLSH

                    p_gt_borrador.csv

                    • Path C:\Users\Admin\AppData\Local\Temp\TestFuenteGTReglaDeSeleccionCSV_+_jsonl_importado368413912\002\p_gt_borrador.csv
                    • Size 115B
                    • SHA256 88e882a4650375816cbd03320b562af9ca672f5d64ef082f377595ff0ebe5572
                    • MD5 SHA1 SHA512 TLSH

                    gt_revision.jsonl

                    • Path C:\Users\Admin\AppData\Local\Temp\TestFuenteGTReglaDeSeleccionjsonl_importado_sin_CSV1450990032\001\gt\gt_revision.jsonl
                    • Size 126B
                    • SHA256 1ddd66ec8285aa51a1dd5fa7ade1b384da4f7b0a8e6daf213a6001dbc777e05f
                    • MD5 SHA1 SHA512 TLSH

                    config.json

                    • Path C:\Users\Admin\AppData\Local\Temp\TestListadoSinteticoYCalculoEnSegundoPlano3904501178\001\OutputFullAnalyzer\game-test\vivo\20261101_100000_real\config.json
                    • Size 125B
                    • SHA256 213ced6819d599d5cf00e8b135737c705d90a07db161d3b42f1687ec796cbfda
                    • MD5 SHA1 SHA512 TLSH

                    hechos.jsonl

                    • Path C:\Users\Admin\AppData\Local\Temp\TestListadoSinteticoYCalculoEnSegundoPlano3904501178\001\OutputFullAnalyzer\game-test\vivo\20261101_100000_real\hechos.jsonl
                    • Size 864B
                    • SHA256 ec90f5012e7061f5938267d2348dae5fb3d989cfe93cabe62b405da88d5e694b
                    • MD5 SHA1 SHA512 TLSH

                    medicion.json

                    • Path C:\Users\Admin\AppData\Local\Temp\TestListadoSinteticoYCalculoEnSegundoPlano3904501178\001\OutputFullAnalyzer\game-test\vivo\20261101_100000_real\medicion.json
                    • Size 22B
                    • SHA256 f944c4d801e3ce7be87c5e9647028c3b2b7c0108e852142963798880293fbd5f
                    • MD5 SHA1 SHA512

                    config.json

                    • Path C:\Users\Admin\AppData\Local\Temp\TestListadoSinteticoYCalculoEnSegundoPlano3904501178\001\OutputFullAnalyzer\game-test\vivo\20261102_100000_sim\config.json
                    • Size 18B
                    • SHA256 9c5da94e7f561b1862d7b50d9bfc2df546116184cee5be808f4241c8ff9137d8
                    • MD5 SHA1 SHA512

                    medicion.json

                    • Path C:\Users\Admin\AppData\Local\Temp\TestListadoSinteticoYCalculoEnSegundoPlano3904501178\001\OutputFullAnalyzer\game-test\vivo\20261102_100000_sim\medicion.json
                    • Size 2B
                    • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                    • MD5 SHA1 SHA512

                    config.json

                    • Path C:\Users\Admin\AppData\Local\Temp\TestListadoSinteticoYCalculoEnSegundoPlano3904501178\001\OutputFullAnalyzer\game-test\vivo\sin_fecha_en_el_nombre\config.json
                    • Size 107B
                    • SHA256 51bd1c89e3571d5e18a1f5a8fcbed2c80d7ab036056acd75bdbc6ae0e2e145c0
                    • MD5 SHA1 SHA512 TLSH

                    medicion.json

                    • Path C:\Users\Admin\AppData\Local\Temp\TestListadoSinteticoYCalculoEnSegundoPlano3904501178\001\OutputFullAnalyzer\game-test\vivo\sin_fecha_en_el_nombre\medicion.json
                    • Size 21B
                    • SHA256 e12647931ba111781664b99b8c35edbd50bf20e6a45b4ed9e5548ac657b78491
                    • MD5 SHA1 SHA512

                    31078448809cbc3f.json

                    • Path C:\Users\Admin\AppData\Local\Temp\TestListadoSinteticoYCalculoEnSegundoPlano3904501178\001\cache\31078448809cbc3f.json
                    • Size 1KB
                    • SHA256 c51a44dc79be51db385c1996d1f58547648a757ccf1a4b014713bf25bd02ffdd
                    • MD5 SHA1 SHA512 TLSH

                    74ad3cbb0cc6481c.json

                    • Path C:\Users\Admin\AppData\Local\Temp\TestListadoSinteticoYCalculoEnSegundoPlano3904501178\001\cache\74ad3cbb0cc6481c.json
                    • Size 1KB
                    • SHA256 7b9b7f1f4bd639340afd778025d135b85209e6b8390d5367a4b06c64878e3d31
                    • MD5 SHA1 SHA512 TLSH

                    e379111ccf323074.json

                    • Path C:\Users\Admin\AppData\Local\Temp\TestListadoSinteticoYCalculoEnSegundoPlano3904501178\001\cache\e379111ccf323074.json
                    • Size 1KB
                    • SHA256 f6f33710ae22f8c3a142b6604dde9051d6de47ecaf22d88169f1a8d2e4a96f3f
                    • MD5 SHA1 SHA512 TLSH

                    config.yaml

                    • Path C:\Users\Admin\AppData\Local\Temp\TestListadoSinteticoYCalculoEnSegundoPlano3904501178\001\config.yaml
                    • Size 1008B
                    • SHA256 e6e4dd522d012f27f17d00958191117c5f3254ed1ba3303c1817c89bb748e282
                    • MD5 SHA1 SHA512 TLSH

                    game-test_gt_borrador.csv

                    • Path C:\Users\Admin\AppData\Local\Temp\TestListadoSinteticoYCalculoEnSegundoPlano3904501178\001\gt\game-test_gt_borrador.csv
                    • Size 158B
                    • SHA256 1bc7456cd7cd385dde54f892c6afbea8b3f0071f8d51fde6926c211bee99f848
                    • MD5 SHA1 SHA512 TLSH

                    game-test_gt_borrador.csv

                    • Path C:\Users\Admin\AppData\Local\Temp\TestListadoSinteticoYCalculoEnSegundoPlano3904501178\001\gt\game-test_gt_borrador.csv
                    • Size 118B
                    • SHA256 544368f5d75b9f9051b597c0bbb8b36fc8b1fec166e9a4e1b880e4cf8fedb314
                    • MD5 SHA1 SHA512 TLSH

                    config.yaml

                    • Path C:\Users\Admin\AppData\Local\Temp\TestSeguridadYSecciones3532842316\001\config.yaml
                    • Size 932B
                    • SHA256 72df7a3347da8b2a39243a25d9a8fa55403386a0d4e3a523f7ece73cd0104425
                    • MD5 SHA1 SHA512 TLSH

                    config.yaml

                    • Path C:\Users\Admin\AppData\Local\Temp\TestSeguridadYSecciones3532842316\001\config.yaml
                    • Size 996B
                    • SHA256 f4005903d6d5f8577655e71fd9cfc79a67322c2d480ed74e8765294b54c8d1e8
                    • MD5 SHA1 SHA512 TLSH