Analysis

  • max time kernel
    150s
  • max time network
    125s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    23/10/2026, 10:06

General

  • Target
    2026-10-23_86854899b8577e9ee85ae577e0df269e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  • Size 9.2MB
  • Sample261023-l5bblscf32
  • SHA256 8f7f1a7ae0fbc224824bdbd0770ea7ac918a85e2937c4e7aa2f781544256623d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10

Malware Config

Signatures

  • Discovers running processes 1 TTPs 4 IoCs

    Running process information can be used to identify security tools or plan follow-on actions.

  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-23_86854899b8577e9ee85ae577e0df269e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-23_86854899b8577e9ee85ae577e0df269e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4572
    • C:\Users\Admin\AppData\Local\Temp\2026-10-23_86854899b8577e9ee85ae577e0df269e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2026-10-23_86854899b8577e9ee85ae577e0df269e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -test.run=TestProcesoFalso -- 51505
      2⤵
        PID:348
      • C:\Users\Admin\AppData\Local\Temp\2026-10-23_86854899b8577e9ee85ae577e0df269e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        C:\Users\Admin\AppData\Local\Temp\2026-10-23_86854899b8577e9ee85ae577e0df269e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -test.run=TestProcesoFalso -- 51513
        2⤵
          PID:2160
        • C:\Windows\system32\tasklist.exe
          tasklist /FI "PID eq 348" /NH
          2⤵
          • Discovers running processes
          • Suspicious use of AdjustPrivilegeToken
          PID:256
        • C:\Windows\system32\tasklist.exe
          tasklist /FI "PID eq 348" /NH
          2⤵
          • Discovers running processes
          • Suspicious use of AdjustPrivilegeToken
          PID:3768
        • C:\Windows\system32\tasklist.exe
          tasklist /FI "PID eq 2160" /NH
          2⤵
          • Discovers running processes
          • Suspicious use of AdjustPrivilegeToken
          PID:5456
        • C:\Windows\system32\tasklist.exe
          tasklist /FI "PID eq 2160" /NH
          2⤵
          • Discovers running processes
          • Suspicious use of AdjustPrivilegeToken
          PID:1592
        • C:\Users\Admin\AppData\Local\Temp\2026-10-23_86854899b8577e9ee85ae577e0df269e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
          C:\Users\Admin\AppData\Local\Temp\2026-10-23_86854899b8577e9ee85ae577e0df269e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -test.run=TestProcesoFalso -- 51518
          2⤵
            PID:4888
          • C:\Users\Admin\AppData\Local\Temp\2026-10-23_86854899b8577e9ee85ae577e0df269e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
            C:\Users\Admin\AppData\Local\Temp\2026-10-23_86854899b8577e9ee85ae577e0df269e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -test.run=TestProcesoFalso -- 51521
            2⤵
              PID:4700
            • C:\Users\Admin\AppData\Local\Temp\2026-10-23_86854899b8577e9ee85ae577e0df269e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
              C:\Users\Admin\AppData\Local\Temp\2026-10-23_86854899b8577e9ee85ae577e0df269e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -test.run=NoExisteEsteTest
              2⤵
                PID:3340
              • C:\Users\Admin\AppData\Local\Temp\2026-10-23_86854899b8577e9ee85ae577e0df269e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
                C:\Users\Admin\AppData\Local\Temp\2026-10-23_86854899b8577e9ee85ae577e0df269e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -test.run=TestProcesoFalso -- 51580 http:///revisar/ C:\Users\Admin\AppData\Local\Temp\TestApiReplayAbreYCierra3341132103\001\gt\game-test_gt_borrador.csv
                2⤵
                  PID:4680

              Network

                    MITRE ATT&CK Enterprise v16

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    config.yaml

                    • Path C:\Users\Admin\AppData\Local\Temp\TestApiReplayAbreYCierra3341132103\001\config.yaml
                    • Size 936B
                    • SHA256 92ec70258f4d84fdf3038956365cb9396bd79d61cb54cb1e75c90dcf37552946
                    • MD5 SHA1 SHA512 TLSH

                    game-test_bases_ref.jpg

                    • Path C:\Users\Admin\AppData\Local\Temp\TestApiReplayAbreYCierra3341132103\001\videos\game-test_bases_ref.jpg
                    • Size 8B
                    • SHA256 3974fc53fcaa9281ca0f47474befa8f5edba9ae7740f8b7ec66e1bd3e3aa6f38
                    • MD5 SHA1 SHA512

                    config.yaml

                    • Path C:\Users\Admin\AppData\Local\Temp\TestArgsReplayYImportacionDelGT4166052493\001\config.yaml
                    • Size 964B
                    • SHA256 f18c0d127addb0713ff2187933c02031c42830bb5d90d6b4732cad8af3f3a1d4
                    • MD5 SHA1 SHA512 TLSH

                    jugadas_raw.jsonl

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselineAgregadoSumaYNoPromedia1138815307\001\OutputFullAnalyzer\game-singt\vivo\20261101_130000_sol\lvm\jugadas_raw.jsonl
                    • Size 588B
                    • SHA256 c5774255b14cd19b0af41a146048066c9814b3bbab5ebbc65451447f6643f1bf
                    • MD5 SHA1 SHA512 TLSH

                    config.yaml

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselineAgregadoSumaYNoPromedia1138815307\001\config.yaml
                    • Size 1KB
                    • SHA256 806f0e63940eba4ba43412f97346d379486c54d6e2e032500bd3caa1963fd032
                    • MD5 SHA1 SHA512 TLSH

                    608cc0b07d77486cd891ab9f3f1a44a0723516f7.json

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselineCacheYHuella2726556019\001\cache\baseline\608cc0b07d77486cd891ab9f3f1a44a0723516f7.json
                    • Size 6KB
                    • SHA256 cc03a9788862b43abb15935e1eff4050c23c60e734fbd000a288e9f8ce681c6a
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    config.yaml

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselineCacheYHuella2726556019\001\config.yaml
                    • Size 1KB
                    • SHA256 903b37e1c359914f3d85f8c110a048ce0a6d2a9335e4d7499772496194d425ef
                    • MD5 SHA1 SHA512 TLSH

                    config.yaml

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselineGTDeUnCSVElegidoYSelector1020867623\001\config.yaml
                    • Size 1KB
                    • SHA256 ebff51433af15671ab5f64075ec0f6f6fa1665d6167915e6b96eebe62174e26a
                    • MD5 SHA1 SHA512 TLSH

                    jugadas_raw.jsonl

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselineNoEscribeFueraDeLaCache3553154280\001\OutputFullAnalyzer\game-bl2\vivo\20261101_110000_sol\lvm\jugadas_raw.jsonl
                    • Size 578B
                    • SHA256 88084e81b7b3f646ad663522fb6a13fe6ad0992ec4cdafa4058a6cc7e70a5d1f
                    • MD5 SHA1 SHA512 TLSH

                    hechos.jsonl

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselineNoEscribeFueraDeLaCache3553154280\001\OutputFullAnalyzer\game-bl\vivo\20261102_100000_sim\hechos.jsonl
                    • Size 1KB
                    • SHA256 80b696e5369eba5b2421dc54eb0090e018d72b52ff1c386d80c8d2389c3d21aa
                    • MD5 SHA1 SHA512 TLSH

                    config.yaml

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselineNoEscribeFueraDeLaCache3553154280\001\config.yaml
                    • Size 1KB
                    • SHA256 963c690c2858096fd20f96e0432279e30df30f5c6a801887b44b589e9d28e6c9
                    • MD5 SHA1 SHA512 TLSH

                    game-sincsv_gt_borrador.csv

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselineNoEscribeFueraDeLaCache3553154280\001\gt\game-sincsv_gt_borrador.csv
                    • Size 34B
                    • SHA256 b861a8c0289c4af8f00bafe6f9830c1647e00854afdc66dec45e39bab2fefd94
                    • MD5 SHA1 SHA512

                    game-bl2.mov

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselineNoEscribeFueraDeLaCache3553154280\001\videos\game-bl2.mov
                    • Size 10B
                    • SHA256 870391cb8b7042f102d6d2459264e1de02d3bf15d8bb5840cf1aae4e8cb52943
                    • MD5 SHA1 SHA512

                    config.yaml

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselinePaginasYPartidos1700534959\001\config.yaml
                    • Size 1KB
                    • SHA256 a2f2d378d44509442d60b0626c3c824e1ef192f6468d836554de2dfaeb77eaa3
                    • MD5 SHA1 SHA512 TLSH

                    config.yaml

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselineSeguridad3108503487\001\config.yaml
                    • Size 1019B
                    • SHA256 8eb7cf76a613ce9f5cd076420385b02fa0e54541bfbef3b5440672bc3f0972dd
                    • MD5 SHA1 SHA512 TLSH

                    jugadas_raw.jsonl

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselineSinCSVoSinGTEsSinDatosYNoCero2278217780\001\OutputFullAnalyzer\game-bl\vivo\20261102_100000_sim\lvm\jugadas_raw.jsonl
                    • Size 590B
                    • SHA256 06bf10ba895e33c60fd0d4f07f849665ac3f567762342e15336f6df07129f7a0
                    • MD5 SHA1 SHA512 TLSH

                    jugadas_raw.jsonl

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselineSinCSVoSinGTEsSinDatosYNoCero2278217780\001\OutputFullAnalyzer\game-sincsv\vivo\20261101_120000_sol\lvm\jugadas_raw.jsonl
                    • Size 593B
                    • SHA256 7d465a485e3671a3e58d411a9e8c1343159e23082c4d2df6ddec5179145208c5
                    • MD5 SHA1 SHA512 TLSH

                    pitch-results-game-bl2.csv

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselineSinCSVoSinGTEsSinDatosYNoCero2278217780\001\baselines\pitch-results-game-bl2.csv
                    • Size 148B
                    • SHA256 7f58338abff4bb4ad7c202a1609d4cce0d87c9e02e7cf9ae4bfcf994474f7aa4
                    • MD5 SHA1 SHA512 TLSH

                    config.yaml

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselineSinCSVoSinGTEsSinDatosYNoCero2278217780\001\config.yaml
                    • Size 1KB
                    • SHA256 b3c035af92cc59eaec95fc51763591bb9a50881e77fdd2a16756d88bae89a7e4
                    • MD5 SHA1 SHA512 TLSH

                    gt_revision.jsonl

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselineUnPartidoSintetico1336357561\001\OutputFullAnalyzer\game-bl\vivo\20261101_100000_sol\gt\gt_revision.jsonl
                    • Size 550B
                    • SHA256 42a27373db640f4a452d37d0f582f92bcbe27d57616cfa8e8775e10db86e18cc
                    • MD5 SHA1 SHA512 TLSH

                    jugadas_raw.jsonl

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselineUnPartidoSintetico1336357561\001\OutputFullAnalyzer\game-bl\vivo\20261101_100000_sol\lvm\jugadas_raw.jsonl
                    • Size 573B
                    • SHA256 0cd1d21fabc7c28aeecc044bfe9115c5542c7921097c4903d5ff7546b5e54900
                    • MD5 SHA1 SHA512 TLSH

                    config.json

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselineUnPartidoSintetico1336357561\001\OutputFullAnalyzer\game-bl\vivo\20261102_100000_sim\config.json
                    • Size 84B
                    • SHA256 9154cf6959718b96567857e8565cc66ff0d0ada9e6f8b7157d48897dc38bb31c
                    • MD5 SHA1 SHA512 TLSH

                    events_manifest.jsonl

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselineUnPartidoSintetico1336357561\001\OutputFullAnalyzer\game-sincsv\vivo\20261101_120000_sol\captura\game-sincsv\events_manifest.jsonl
                    • Size 380B
                    • SHA256 a0624193557e6272ff145ca9c647a59b7b3d91af2ae8e0c837a20cf181c95f18
                    • MD5 SHA1 SHA512 TLSH

                    medicion.json

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselineUnPartidoSintetico1336357561\001\OutputFullAnalyzer\game-sincsv\vivo\20261101_120000_sol\medicion.json
                    • Size 52B
                    • SHA256 2dfcd907fe8b3b8d2e72b37159199c82d7012ddb5ec1bed6d427c8e9abb8501f
                    • MD5 SHA1 SHA512 TLSH

                    config.json

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselineUnPartidoSintetico1336357561\001\OutputFullAnalyzer\game-singt\vivo\20261101_130000_sol\config.json
                    • Size 79B
                    • SHA256 1376ac79f161b8137b6f6dbe8c311486190467b01303ac06806400508dbbee79
                    • MD5 SHA1 SHA512 TLSH

                    hechos.jsonl

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselineUnPartidoSintetico1336357561\001\OutputFullAnalyzer\game-singt\vivo\20261101_130000_sol\hechos.jsonl
                    • Size 1KB
                    • SHA256 67134db10221d146175f3704577007e09778363c9f14342283a04ffdea07dfb8
                    • MD5 SHA1 SHA512 TLSH

                    pitch-results-bl.csv

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselineUnPartidoSintetico1336357561\001\baselines\pitch-results-bl.csv
                    • Size 330B
                    • SHA256 27494149175673306282517be82d588f67211dd008c4e63b0de909d3b398d42a
                    • MD5 SHA1 SHA512 TLSH

                    config.yaml

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselineUnPartidoSintetico1336357561\001\config.yaml
                    • Size 1KB
                    • SHA256 3c210ede66a5a35288eb25198e7ca19b269a2f7178b84cf251e7e5cbc4615bfe
                    • MD5 SHA1 SHA512 TLSH

                    p_gt_borrador.csv

                    • Path C:\Users\Admin\AppData\Local\Temp\TestFuenteGTReglaDeSeleccionCSV_+_jsonl_importado47156402\002\p_gt_borrador.csv
                    • Size 115B
                    • SHA256 88e882a4650375816cbd03320b562af9ca672f5d64ef082f377595ff0ebe5572
                    • MD5 SHA1 SHA512 TLSH

                    gt_revision.jsonl

                    • Path C:\Users\Admin\AppData\Local\Temp\TestFuenteGTReglaDeSeleccionjsonl_importado_sin_CSV1526671422\001\gt\gt_revision.jsonl
                    • Size 126B
                    • SHA256 1ddd66ec8285aa51a1dd5fa7ade1b384da4f7b0a8e6daf213a6001dbc777e05f
                    • MD5 SHA1 SHA512 TLSH

                    config.json

                    • Path C:\Users\Admin\AppData\Local\Temp\TestListadoSinteticoYCalculoEnSegundoPlano4135947927\001\OutputFullAnalyzer\game-test\vivo\20261101_100000_real\config.json
                    • Size 125B
                    • SHA256 213ced6819d599d5cf00e8b135737c705d90a07db161d3b42f1687ec796cbfda
                    • MD5 SHA1 SHA512 TLSH

                    hechos.jsonl

                    • Path C:\Users\Admin\AppData\Local\Temp\TestListadoSinteticoYCalculoEnSegundoPlano4135947927\001\OutputFullAnalyzer\game-test\vivo\20261101_100000_real\hechos.jsonl
                    • Size 864B
                    • SHA256 ec90f5012e7061f5938267d2348dae5fb3d989cfe93cabe62b405da88d5e694b
                    • MD5 SHA1 SHA512 TLSH

                    medicion.json

                    • Path C:\Users\Admin\AppData\Local\Temp\TestListadoSinteticoYCalculoEnSegundoPlano4135947927\001\OutputFullAnalyzer\game-test\vivo\20261101_100000_real\medicion.json
                    • Size 22B
                    • SHA256 f944c4d801e3ce7be87c5e9647028c3b2b7c0108e852142963798880293fbd5f
                    • MD5 SHA1 SHA512

                    config.json

                    • Path C:\Users\Admin\AppData\Local\Temp\TestListadoSinteticoYCalculoEnSegundoPlano4135947927\001\OutputFullAnalyzer\game-test\vivo\20261102_100000_sim\config.json
                    • Size 18B
                    • SHA256 9c5da94e7f561b1862d7b50d9bfc2df546116184cee5be808f4241c8ff9137d8
                    • MD5 SHA1 SHA512

                    medicion.json

                    • Path C:\Users\Admin\AppData\Local\Temp\TestListadoSinteticoYCalculoEnSegundoPlano4135947927\001\OutputFullAnalyzer\game-test\vivo\20261102_100000_sim\medicion.json
                    • Size 2B
                    • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                    • MD5 SHA1 SHA512

                    config.json

                    • Path C:\Users\Admin\AppData\Local\Temp\TestListadoSinteticoYCalculoEnSegundoPlano4135947927\001\OutputFullAnalyzer\game-test\vivo\sin_fecha_en_el_nombre\config.json
                    • Size 107B
                    • SHA256 51bd1c89e3571d5e18a1f5a8fcbed2c80d7ab036056acd75bdbc6ae0e2e145c0
                    • MD5 SHA1 SHA512 TLSH

                    medicion.json

                    • Path C:\Users\Admin\AppData\Local\Temp\TestListadoSinteticoYCalculoEnSegundoPlano4135947927\001\OutputFullAnalyzer\game-test\vivo\sin_fecha_en_el_nombre\medicion.json
                    • Size 21B
                    • SHA256 e12647931ba111781664b99b8c35edbd50bf20e6a45b4ed9e5548ac657b78491
                    • MD5 SHA1 SHA512

                    31078448809cbc3f.json

                    • Path C:\Users\Admin\AppData\Local\Temp\TestListadoSinteticoYCalculoEnSegundoPlano4135947927\001\cache\31078448809cbc3f.json
                    • Size 1KB
                    • SHA256 57c3fb3862988883e23ca09fc813370e205a6439f1e3f017a0c8c0a02cb1cee8
                    • MD5 SHA1 SHA512 TLSH

                    74ad3cbb0cc6481c.json

                    • Path C:\Users\Admin\AppData\Local\Temp\TestListadoSinteticoYCalculoEnSegundoPlano4135947927\001\cache\74ad3cbb0cc6481c.json
                    • Size 1KB
                    • SHA256 da3df490fbdb1ba443c72efa338b7778edee0845bf5909e0f24eac45fbcbc1a4
                    • MD5 SHA1 SHA512 TLSH

                    e379111ccf323074.json

                    • Path C:\Users\Admin\AppData\Local\Temp\TestListadoSinteticoYCalculoEnSegundoPlano4135947927\001\cache\e379111ccf323074.json
                    • Size 1KB
                    • SHA256 1d339c89ea01104039a74febd2bfcfc4774641a43e1bc0ea5fded89c71036d5b
                    • MD5 SHA1 SHA512 TLSH

                    config.yaml

                    • Path C:\Users\Admin\AppData\Local\Temp\TestListadoSinteticoYCalculoEnSegundoPlano4135947927\001\config.yaml
                    • Size 1008B
                    • SHA256 eba6811cabe53abf6823dcae765b3613883a1f60b5d5d827dc2eaaab6374e663
                    • MD5 SHA1 SHA512 TLSH

                    game-test_gt_borrador.csv

                    • Path C:\Users\Admin\AppData\Local\Temp\TestListadoSinteticoYCalculoEnSegundoPlano4135947927\001\gt\game-test_gt_borrador.csv
                    • Size 158B
                    • SHA256 1bc7456cd7cd385dde54f892c6afbea8b3f0071f8d51fde6926c211bee99f848
                    • MD5 SHA1 SHA512 TLSH

                    game-test_gt_borrador.csv

                    • Path C:\Users\Admin\AppData\Local\Temp\TestListadoSinteticoYCalculoEnSegundoPlano4135947927\001\gt\game-test_gt_borrador.csv
                    • Size 118B
                    • SHA256 544368f5d75b9f9051b597c0bbb8b36fc8b1fec166e9a4e1b880e4cf8fedb314
                    • MD5 SHA1 SHA512 TLSH

                    config.yaml

                    • Path C:\Users\Admin\AppData\Local\Temp\TestSeguridadYSecciones1109547811\001\config.yaml
                    • Size 932B
                    • SHA256 d73f13604f09f32dfaba258cdd1bd8d96ad43b4600a3b98242338a827d15a7ee
                    • MD5 SHA1 SHA512 TLSH

                    config.yaml

                    • Path C:\Users\Admin\AppData\Local\Temp\TestSeguridadYSecciones1109547811\001\config.yaml
                    • Size 996B
                    • SHA256 57448b2c2b92f5a3f26b9b7889f357c3efd4315570e7880d4e891ee294730aa0
                    • MD5 SHA1 SHA512 TLSH