Analysis

  • max time kernel
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    23/10/2026, 10:38

General

  • Target
    2026-10-23_78c647520f5e9c96f2e0ececbb8852fd_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  • Size 9.2MB
  • Sample261023-mpff3adt3p
  • SHA256 d16aa91b6d18ee44c6dcdb429e5d493ac3231b6aab685c108517e0a24e9a028d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10

Malware Config

Signatures

  • Discovers running processes 1 TTPs 4 IoCs

    Running process information can be used to identify security tools or plan follow-on actions.

  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-23_78c647520f5e9c96f2e0ececbb8852fd_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-23_78c647520f5e9c96f2e0ececbb8852fd_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1504
    • C:\Users\Admin\AppData\Local\Temp\2026-10-23_78c647520f5e9c96f2e0ececbb8852fd_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2026-10-23_78c647520f5e9c96f2e0ececbb8852fd_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -test.run=TestProcesoFalso -- 51480
      2⤵
        PID:5360
      • C:\Users\Admin\AppData\Local\Temp\2026-10-23_78c647520f5e9c96f2e0ececbb8852fd_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
        C:\Users\Admin\AppData\Local\Temp\2026-10-23_78c647520f5e9c96f2e0ececbb8852fd_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -test.run=TestProcesoFalso -- 51487
        2⤵
          PID:1448
        • C:\Windows\system32\tasklist.exe
          tasklist /FI "PID eq 5360" /NH
          2⤵
          • Discovers running processes
          • Suspicious use of AdjustPrivilegeToken
          PID:3188
        • C:\Windows\system32\tasklist.exe
          tasklist /FI "PID eq 5360" /NH
          2⤵
          • Discovers running processes
          • Suspicious use of AdjustPrivilegeToken
          PID:4456
        • C:\Windows\system32\tasklist.exe
          tasklist /FI "PID eq 1448" /NH
          2⤵
          • Discovers running processes
          • Suspicious use of AdjustPrivilegeToken
          PID:1412
        • C:\Windows\system32\tasklist.exe
          tasklist /FI "PID eq 1448" /NH
          2⤵
          • Discovers running processes
          • Suspicious use of AdjustPrivilegeToken
          PID:1472
        • C:\Users\Admin\AppData\Local\Temp\2026-10-23_78c647520f5e9c96f2e0ececbb8852fd_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
          C:\Users\Admin\AppData\Local\Temp\2026-10-23_78c647520f5e9c96f2e0ececbb8852fd_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -test.run=TestProcesoFalso -- 51492
          2⤵
            PID:6048
          • C:\Users\Admin\AppData\Local\Temp\2026-10-23_78c647520f5e9c96f2e0ececbb8852fd_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
            C:\Users\Admin\AppData\Local\Temp\2026-10-23_78c647520f5e9c96f2e0ececbb8852fd_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -test.run=TestProcesoFalso -- 51495
            2⤵
              PID:3424
            • C:\Users\Admin\AppData\Local\Temp\2026-10-23_78c647520f5e9c96f2e0ececbb8852fd_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
              C:\Users\Admin\AppData\Local\Temp\2026-10-23_78c647520f5e9c96f2e0ececbb8852fd_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -test.run=NoExisteEsteTest
              2⤵
                PID:2328
              • C:\Users\Admin\AppData\Local\Temp\2026-10-23_78c647520f5e9c96f2e0ececbb8852fd_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
                C:\Users\Admin\AppData\Local\Temp\2026-10-23_78c647520f5e9c96f2e0ececbb8852fd_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe -test.run=TestProcesoFalso -- 51550 http:///revisar/ C:\Users\Admin\AppData\Local\Temp\TestApiReplayAbreYCierra2542405799\001\gt\game-test_gt_borrador.csv
                2⤵
                  PID:3936

              Network

                    MITRE ATT&CK Enterprise v16

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    config.yaml

                    • Path C:\Users\Admin\AppData\Local\Temp\TestApiReplayAbreYCierra2542405799\001\config.yaml
                    • Size 936B
                    • SHA256 41e3686c57293602c5d8ecf42132990b1753d1473c6e9bfe3a27a989f89f3dc5
                    • MD5 SHA1 SHA512 TLSH

                    game-test_bases_ref.jpg

                    • Path C:\Users\Admin\AppData\Local\Temp\TestApiReplayAbreYCierra2542405799\001\videos\game-test_bases_ref.jpg
                    • Size 8B
                    • SHA256 3974fc53fcaa9281ca0f47474befa8f5edba9ae7740f8b7ec66e1bd3e3aa6f38
                    • MD5 SHA1 SHA512

                    config.yaml

                    • Path C:\Users\Admin\AppData\Local\Temp\TestArgsReplayYImportacionDelGT1863948322\001\config.yaml
                    • Size 964B
                    • SHA256 6a3eec90203788f4ede8f43b127a8e03a18f3b0c6f9f6e2a0d47ac2ba9a65245
                    • MD5 SHA1 SHA512 TLSH

                    jugadas_raw.jsonl

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselineAgregadoSumaYNoPromedia2382595316\001\OutputFullAnalyzer\game-singt\vivo\20261101_130000_sol\lvm\jugadas_raw.jsonl
                    • Size 588B
                    • SHA256 c5774255b14cd19b0af41a146048066c9814b3bbab5ebbc65451447f6643f1bf
                    • MD5 SHA1 SHA512 TLSH

                    config.yaml

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselineAgregadoSumaYNoPromedia2382595316\001\config.yaml
                    • Size 1KB
                    • SHA256 c79487ffa7a7685977e26d1b1f52f82a256f0b2446d02e64559b508ff24c0b9a
                    • MD5 SHA1 SHA512 TLSH

                    gt_revision.jsonl

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselineCacheYHuella870435051\001\OutputFullAnalyzer\game-bl\vivo\20261101_100000_sol\gt\gt_revision.jsonl
                    • Size 660B
                    • SHA256 bb77919f3d9565b39fe44f94b3d1b85f5502ab7bee4a7af2e1509c0245377d6d
                    • MD5 SHA1 SHA512 TLSH

                    0a05126bf21315db6dc2d7b145c3211c8e18b4cf.json

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselineCacheYHuella870435051\001\cache\baseline\0a05126bf21315db6dc2d7b145c3211c8e18b4cf.json
                    • Size 6KB
                    • SHA256 6786d9d83ebdb79fca60ea73ad86e9e6d665be120e53f74f9d58c0c19ee63d9d
                    • MD5 SHA1 SHA512 SSDEEP TLSH

                    config.yaml

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselineCacheYHuella870435051\001\config.yaml
                    • Size 1KB
                    • SHA256 f83ba32af375c6c62bbf6d31370e90af97b01514d6e6175351ecbef70ad7609b
                    • MD5 SHA1 SHA512 TLSH

                    config.yaml

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselineGTDeUnCSVElegidoYSelector3833086007\001\config.yaml
                    • Size 1KB
                    • SHA256 35bcb11188241420fafb6698e0d2e8522fbb5837502bcd18d6a0b12ee1aa755b
                    • MD5 SHA1 SHA512 TLSH

                    jugadas_raw.jsonl

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselineNoEscribeFueraDeLaCache3888224428\001\OutputFullAnalyzer\game-bl2\vivo\20261101_110000_sol\lvm\jugadas_raw.jsonl
                    • Size 578B
                    • SHA256 88084e81b7b3f646ad663522fb6a13fe6ad0992ec4cdafa4058a6cc7e70a5d1f
                    • MD5 SHA1 SHA512 TLSH

                    hechos.jsonl

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselineNoEscribeFueraDeLaCache3888224428\001\OutputFullAnalyzer\game-bl\vivo\20261102_100000_sim\hechos.jsonl
                    • Size 1KB
                    • SHA256 80b696e5369eba5b2421dc54eb0090e018d72b52ff1c386d80c8d2389c3d21aa
                    • MD5 SHA1 SHA512 TLSH

                    config.yaml

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselineNoEscribeFueraDeLaCache3888224428\001\config.yaml
                    • Size 1KB
                    • SHA256 8afe9810e88bb584f92d0cacc04c4414ad9f61e8c85de07418a54448bd763afb
                    • MD5 SHA1 SHA512 TLSH

                    game-sincsv_gt_borrador.csv

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselineNoEscribeFueraDeLaCache3888224428\001\gt\game-sincsv_gt_borrador.csv
                    • Size 34B
                    • SHA256 b861a8c0289c4af8f00bafe6f9830c1647e00854afdc66dec45e39bab2fefd94
                    • MD5 SHA1 SHA512

                    game-bl2.mov

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselineNoEscribeFueraDeLaCache3888224428\001\videos\game-bl2.mov
                    • Size 10B
                    • SHA256 870391cb8b7042f102d6d2459264e1de02d3bf15d8bb5840cf1aae4e8cb52943
                    • MD5 SHA1 SHA512

                    config.yaml

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselinePaginasYPartidos3674970848\001\config.yaml
                    • Size 1KB
                    • SHA256 66ac498464fc2eee05164b45ba29de5788255b30eb7e7899cc645f4fecbd248b
                    • MD5 SHA1 SHA512 TLSH

                    config.yaml

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselineSeguridad658994102\001\config.yaml
                    • Size 1014B
                    • SHA256 1ceb34cee5b5479227a84892c0ce748c66c518fc98981dae843c6b34172e364b
                    • MD5 SHA1 SHA512 TLSH

                    jugadas_raw.jsonl

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselineSinCSVoSinGTEsSinDatosYNoCero3541214262\001\OutputFullAnalyzer\game-bl\vivo\20261102_100000_sim\lvm\jugadas_raw.jsonl
                    • Size 590B
                    • SHA256 06bf10ba895e33c60fd0d4f07f849665ac3f567762342e15336f6df07129f7a0
                    • MD5 SHA1 SHA512 TLSH

                    jugadas_raw.jsonl

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselineSinCSVoSinGTEsSinDatosYNoCero3541214262\001\OutputFullAnalyzer\game-sincsv\vivo\20261101_120000_sol\lvm\jugadas_raw.jsonl
                    • Size 593B
                    • SHA256 7d465a485e3671a3e58d411a9e8c1343159e23082c4d2df6ddec5179145208c5
                    • MD5 SHA1 SHA512 TLSH

                    pitch-results-game-bl2.csv

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselineSinCSVoSinGTEsSinDatosYNoCero3541214262\001\baselines\pitch-results-game-bl2.csv
                    • Size 148B
                    • SHA256 7f58338abff4bb4ad7c202a1609d4cce0d87c9e02e7cf9ae4bfcf994474f7aa4
                    • MD5 SHA1 SHA512 TLSH

                    config.yaml

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselineSinCSVoSinGTEsSinDatosYNoCero3541214262\001\config.yaml
                    • Size 1KB
                    • SHA256 d28ca08574bd6506e0e66527d0f737a7353d01e6df5eb5a38f0c4719e25ec19d
                    • MD5 SHA1 SHA512 TLSH

                    gt_revision.jsonl

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselineUnPartidoSintetico1444352741\001\OutputFullAnalyzer\game-bl\vivo\20261101_100000_sol\gt\gt_revision.jsonl
                    • Size 550B
                    • SHA256 42a27373db640f4a452d37d0f582f92bcbe27d57616cfa8e8775e10db86e18cc
                    • MD5 SHA1 SHA512 TLSH

                    jugadas_raw.jsonl

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselineUnPartidoSintetico1444352741\001\OutputFullAnalyzer\game-bl\vivo\20261101_100000_sol\lvm\jugadas_raw.jsonl
                    • Size 573B
                    • SHA256 0cd1d21fabc7c28aeecc044bfe9115c5542c7921097c4903d5ff7546b5e54900
                    • MD5 SHA1 SHA512 TLSH

                    config.json

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselineUnPartidoSintetico1444352741\001\OutputFullAnalyzer\game-bl\vivo\20261102_100000_sim\config.json
                    • Size 84B
                    • SHA256 9154cf6959718b96567857e8565cc66ff0d0ada9e6f8b7157d48897dc38bb31c
                    • MD5 SHA1 SHA512 TLSH

                    events_manifest.jsonl

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselineUnPartidoSintetico1444352741\001\OutputFullAnalyzer\game-sincsv\vivo\20261101_120000_sol\captura\game-sincsv\events_manifest.jsonl
                    • Size 380B
                    • SHA256 a0624193557e6272ff145ca9c647a59b7b3d91af2ae8e0c837a20cf181c95f18
                    • MD5 SHA1 SHA512 TLSH

                    medicion.json

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselineUnPartidoSintetico1444352741\001\OutputFullAnalyzer\game-sincsv\vivo\20261101_120000_sol\medicion.json
                    • Size 52B
                    • SHA256 2dfcd907fe8b3b8d2e72b37159199c82d7012ddb5ec1bed6d427c8e9abb8501f
                    • MD5 SHA1 SHA512 TLSH

                    config.json

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselineUnPartidoSintetico1444352741\001\OutputFullAnalyzer\game-singt\vivo\20261101_130000_sol\config.json
                    • Size 79B
                    • SHA256 1376ac79f161b8137b6f6dbe8c311486190467b01303ac06806400508dbbee79
                    • MD5 SHA1 SHA512 TLSH

                    hechos.jsonl

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselineUnPartidoSintetico1444352741\001\OutputFullAnalyzer\game-singt\vivo\20261101_130000_sol\hechos.jsonl
                    • Size 1KB
                    • SHA256 67134db10221d146175f3704577007e09778363c9f14342283a04ffdea07dfb8
                    • MD5 SHA1 SHA512 TLSH

                    pitch-results-bl.csv

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselineUnPartidoSintetico1444352741\001\baselines\pitch-results-bl.csv
                    • Size 330B
                    • SHA256 27494149175673306282517be82d588f67211dd008c4e63b0de909d3b398d42a
                    • MD5 SHA1 SHA512 TLSH

                    config.yaml

                    • Path C:\Users\Admin\AppData\Local\Temp\TestBaselineUnPartidoSintetico1444352741\001\config.yaml
                    • Size 1KB
                    • SHA256 5fa402a3b31bd015bb30b320ab4a230d730ec6c72766bd78999ac65a93614a23
                    • MD5 SHA1 SHA512 TLSH

                    p_gt_borrador.csv

                    • Path C:\Users\Admin\AppData\Local\Temp\TestFuenteGTReglaDeSeleccionCSV_+_jsonl_importado2350620435\002\p_gt_borrador.csv
                    • Size 115B
                    • SHA256 88e882a4650375816cbd03320b562af9ca672f5d64ef082f377595ff0ebe5572
                    • MD5 SHA1 SHA512 TLSH

                    gt_revision.jsonl

                    • Path C:\Users\Admin\AppData\Local\Temp\TestFuenteGTReglaDeSeleccionjsonl_importado_sin_CSV1505572324\001\gt\gt_revision.jsonl
                    • Size 126B
                    • SHA256 1ddd66ec8285aa51a1dd5fa7ade1b384da4f7b0a8e6daf213a6001dbc777e05f
                    • MD5 SHA1 SHA512 TLSH

                    config.json

                    • Path C:\Users\Admin\AppData\Local\Temp\TestListadoSinteticoYCalculoEnSegundoPlano809065912\001\OutputFullAnalyzer\game-test\vivo\20261101_100000_real\config.json
                    • Size 125B
                    • SHA256 213ced6819d599d5cf00e8b135737c705d90a07db161d3b42f1687ec796cbfda
                    • MD5 SHA1 SHA512 TLSH

                    hechos.jsonl

                    • Path C:\Users\Admin\AppData\Local\Temp\TestListadoSinteticoYCalculoEnSegundoPlano809065912\001\OutputFullAnalyzer\game-test\vivo\20261101_100000_real\hechos.jsonl
                    • Size 864B
                    • SHA256 ec90f5012e7061f5938267d2348dae5fb3d989cfe93cabe62b405da88d5e694b
                    • MD5 SHA1 SHA512 TLSH

                    medicion.json

                    • Path C:\Users\Admin\AppData\Local\Temp\TestListadoSinteticoYCalculoEnSegundoPlano809065912\001\OutputFullAnalyzer\game-test\vivo\20261101_100000_real\medicion.json
                    • Size 22B
                    • SHA256 f944c4d801e3ce7be87c5e9647028c3b2b7c0108e852142963798880293fbd5f
                    • MD5 SHA1 SHA512

                    config.json

                    • Path C:\Users\Admin\AppData\Local\Temp\TestListadoSinteticoYCalculoEnSegundoPlano809065912\001\OutputFullAnalyzer\game-test\vivo\20261102_100000_sim\config.json
                    • Size 18B
                    • SHA256 9c5da94e7f561b1862d7b50d9bfc2df546116184cee5be808f4241c8ff9137d8
                    • MD5 SHA1 SHA512

                    medicion.json

                    • Path C:\Users\Admin\AppData\Local\Temp\TestListadoSinteticoYCalculoEnSegundoPlano809065912\001\OutputFullAnalyzer\game-test\vivo\20261102_100000_sim\medicion.json
                    • Size 2B
                    • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                    • MD5 SHA1 SHA512

                    config.json

                    • Path C:\Users\Admin\AppData\Local\Temp\TestListadoSinteticoYCalculoEnSegundoPlano809065912\001\OutputFullAnalyzer\game-test\vivo\sin_fecha_en_el_nombre\config.json
                    • Size 107B
                    • SHA256 51bd1c89e3571d5e18a1f5a8fcbed2c80d7ab036056acd75bdbc6ae0e2e145c0
                    • MD5 SHA1 SHA512 TLSH

                    medicion.json

                    • Path C:\Users\Admin\AppData\Local\Temp\TestListadoSinteticoYCalculoEnSegundoPlano809065912\001\OutputFullAnalyzer\game-test\vivo\sin_fecha_en_el_nombre\medicion.json
                    • Size 21B
                    • SHA256 e12647931ba111781664b99b8c35edbd50bf20e6a45b4ed9e5548ac657b78491
                    • MD5 SHA1 SHA512

                    31078448809cbc3f.json

                    • Path C:\Users\Admin\AppData\Local\Temp\TestListadoSinteticoYCalculoEnSegundoPlano809065912\001\cache\31078448809cbc3f.json
                    • Size 1KB
                    • SHA256 28c51344475824afb2b05b278be3e012df845b4084d56eb26eda6e416f1a31f7
                    • MD5 SHA1 SHA512 TLSH

                    74ad3cbb0cc6481c.json

                    • Path C:\Users\Admin\AppData\Local\Temp\TestListadoSinteticoYCalculoEnSegundoPlano809065912\001\cache\74ad3cbb0cc6481c.json
                    • Size 1KB
                    • SHA256 00044812e161ebed3e84f2359dc43cb80608b33c6591ea5cc72ba98fea0c8850
                    • MD5 SHA1 SHA512 TLSH

                    e379111ccf323074.json

                    • Path C:\Users\Admin\AppData\Local\Temp\TestListadoSinteticoYCalculoEnSegundoPlano809065912\001\cache\e379111ccf323074.json
                    • Size 1KB
                    • SHA256 a2e69f57243aebdcdaa92c74cc5c8a2ebe975e10b5f2622a9f3e2a185d06dcca
                    • MD5 SHA1 SHA512 TLSH

                    config.yaml

                    • Path C:\Users\Admin\AppData\Local\Temp\TestListadoSinteticoYCalculoEnSegundoPlano809065912\001\config.yaml
                    • Size 1004B
                    • SHA256 884bedefe4bfd23136dabddd4757ebddce07ecd908d1b074fb20b883c655715f
                    • MD5 SHA1 SHA512 TLSH

                    game-test_gt_borrador.csv

                    • Path C:\Users\Admin\AppData\Local\Temp\TestListadoSinteticoYCalculoEnSegundoPlano809065912\001\gt\game-test_gt_borrador.csv
                    • Size 158B
                    • SHA256 1bc7456cd7cd385dde54f892c6afbea8b3f0071f8d51fde6926c211bee99f848
                    • MD5 SHA1 SHA512 TLSH

                    game-test_gt_borrador.csv

                    • Path C:\Users\Admin\AppData\Local\Temp\TestListadoSinteticoYCalculoEnSegundoPlano809065912\001\gt\game-test_gt_borrador.csv
                    • Size 118B
                    • SHA256 544368f5d75b9f9051b597c0bbb8b36fc8b1fec166e9a4e1b880e4cf8fedb314
                    • MD5 SHA1 SHA512 TLSH

                    config.yaml

                    • Path C:\Users\Admin\AppData\Local\Temp\TestSeguridadYSecciones1986554673\001\config.yaml
                    • Size 932B
                    • SHA256 bff4bd540c99b8d33bf4942656e6850218421efdbf1f152bd797f0278be94c83
                    • MD5 SHA1 SHA512 TLSH

                    config.yaml

                    • Path C:\Users\Admin\AppData\Local\Temp\TestSeguridadYSecciones1986554673\001\config.yaml
                    • Size 996B
                    • SHA256 b0da0b148c91062680724f9bbb9dd1a44d7fa51b05568d7d964af6bf553b0025
                    • MD5 SHA1 SHA512 TLSH