10aacce234ccaa814257bbbfce2af4af46d6d444fe8dd87c3984ccaa9a409270

General

Target
2026-10-22_02370656061cba9f11b36be2cabaae07_coinminer_glassworm_snatch.exe
Size 3.2MB
Sample261024-26xt1acy8w
SHA256 10aacce234ccaa814257bbbfce2af4af46d6d444fe8dd87c3984ccaa9a409270
MD5 02370656061cba9f11b36be2cabaae07
SHA1 ba8084fc213d2978ddf92652bb96fce845646005
SHA512 23f8340909698045d4f1de4a538e05c307da2918b75ce31b4f89531f7594a10a4ddb954186fd314468734a5cad1deb1c12f06dd1fc05dfec3e5bca2e2185d3a6
SSDEEP 49152:uO3Q51J2q1UVxZxvnm7IAQW1MNzW/BTqoAoa:uOkAe8+
TLSH
T132F56A07FCA918F6C2AEE1318966A9527B70BC480B3123D72F50B6782F76BD06D79714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

Identifies Wine through registry keys 2 TTPs 4 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wine	2026-10-22_02370656061cba9f11b36be2cabaae07_coinminer_glassworm_snatch.exe
Key opened	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Wine	2026-10-22_02370656061cba9f11b36be2cabaae07_coinminer_glassworm_snatch.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wine	2026-10-22_02370656061cba9f11b36be2cabaae07_coinminer_glassworm_snatch.exe
Key opened	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Wine	2026-10-22_02370656061cba9f11b36be2cabaae07_coinminer_glassworm_snatch.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefenderTask = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-10-22_02370656061cba9f11b36be2cabaae07_coinminer_glassworm_snatch.exe"	2026-10-22_02370656061cba9f11b36be2cabaae07_coinminer_glassworm_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefenderTask = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-10-22_02370656061cba9f11b36be2cabaae07_coinminer_glassworm_snatch.exe"	2026-10-22_02370656061cba9f11b36be2cabaae07_coinminer_glassworm_snatch.exe

Discovers running processes 1 TTPs 2 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
900	tasklist.exe
4208	tasklist.exe

Launches sc.exe 12 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
840	sc.exe
464	sc.exe
2708	sc.exe
4364	sc.exe
2692	sc.exe
544	sc.exe
2072	sc.exe
1108	sc.exe
4116	sc.exe
1524	sc.exe
1224	sc.exe
4180	sc.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-22_02370656061cba9f11b36be2cabaae07_coinminer_glassworm_snatch.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-22_02370656061cba9f11b36be2cabaae07_coinminer_glassworm_snatch.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	900	tasklist.exe
Token: SeDebugPrivilege	4208	tasklist.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4296 wrote to memory of 900	4296	2026-10-22_02370656061cba9f11b36be2cabaae07_coinminer_glassworm_snatch.exe	89
PID 4296 wrote to memory of 4364	4296	2026-10-22_02370656061cba9f11b36be2cabaae07_coinminer_glassworm_snatch.exe	91
PID 4296 wrote to memory of 2692	4296	2026-10-22_02370656061cba9f11b36be2cabaae07_coinminer_glassworm_snatch.exe	93
PID 4296 wrote to memory of 544	4296	2026-10-22_02370656061cba9f11b36be2cabaae07_coinminer_glassworm_snatch.exe	95
PID 4296 wrote to memory of 4180	4296	2026-10-22_02370656061cba9f11b36be2cabaae07_coinminer_glassworm_snatch.exe	97
PID 4296 wrote to memory of 2072	4296	2026-10-22_02370656061cba9f11b36be2cabaae07_coinminer_glassworm_snatch.exe	99
PID 4296 wrote to memory of 1108	4296	2026-10-22_02370656061cba9f11b36be2cabaae07_coinminer_glassworm_snatch.exe	101
PID 4296 wrote to memory of 4892	4296	2026-10-22_02370656061cba9f11b36be2cabaae07_coinminer_glassworm_snatch.exe	103
PID 4892 wrote to memory of 4248	4892	net.exe	105
PID 3460 wrote to memory of 4208	3460	2026-10-22_02370656061cba9f11b36be2cabaae07_coinminer_glassworm_snatch.exe	109
PID 3460 wrote to memory of 4116	3460	2026-10-22_02370656061cba9f11b36be2cabaae07_coinminer_glassworm_snatch.exe	111
PID 3460 wrote to memory of 1524	3460	2026-10-22_02370656061cba9f11b36be2cabaae07_coinminer_glassworm_snatch.exe	113
PID 3460 wrote to memory of 840	3460	2026-10-22_02370656061cba9f11b36be2cabaae07_coinminer_glassworm_snatch.exe	115
PID 3460 wrote to memory of 464	3460	2026-10-22_02370656061cba9f11b36be2cabaae07_coinminer_glassworm_snatch.exe	117
PID 3460 wrote to memory of 1224	3460	2026-10-22_02370656061cba9f11b36be2cabaae07_coinminer_glassworm_snatch.exe	119
PID 3460 wrote to memory of 2708	3460	2026-10-22_02370656061cba9f11b36be2cabaae07_coinminer_glassworm_snatch.exe	121
PID 3460 wrote to memory of 4908	3460	2026-10-22_02370656061cba9f11b36be2cabaae07_coinminer_glassworm_snatch.exe	123
PID 4908 wrote to memory of 4604	4908	net.exe	125

C:\Users\Admin\AppData\Local\Temp\2026-10-22_02370656061cba9f11b36be2cabaae07_coinminer_glassworm_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_02370656061cba9f11b36be2cabaae07_coinminer_glassworm_snatch.exe"
1⤵
- Identifies Wine through registry keys
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:4296
- C:\Windows\system32\tasklist.exe
  tasklist /fo csv /nh
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:900
- C:\Windows\system32\sc.exe
  sc query SbieSvc
  2⤵
  - Launches sc.exe
  PID:4364
- C:\Windows\system32\sc.exe
  sc query CuckooMon
  2⤵
  - Launches sc.exe
  PID:2692
- C:\Windows\system32\sc.exe
  sc query Joeboxserver
  2⤵
  - Launches sc.exe
  PID:544
- C:\Windows\system32\sc.exe
  sc query cmdvirth
  2⤵
  - Launches sc.exe
  PID:4180
- C:\Windows\system32\sc.exe
  sc query SxIn
  2⤵
  - Launches sc.exe
  PID:2072
- C:\Windows\system32\sc.exe
  sc query SAVAdminService
  2⤵
  - Launches sc.exe
  PID:1108
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4892
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:4248

C:\Users\Admin\AppData\Local\Temp\2026-10-22_02370656061cba9f11b36be2cabaae07_coinminer_glassworm_snatch.exe
C:\Users\Admin\AppData\Local\Temp\2026-10-22_02370656061cba9f11b36be2cabaae07_coinminer_glassworm_snatch.exe
1⤵
- Identifies Wine through registry keys
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:3460
- C:\Windows\system32\tasklist.exe
  tasklist /fo csv /nh
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4208
- C:\Windows\system32\sc.exe
  sc query SbieSvc
  2⤵
  - Launches sc.exe
  PID:4116
- C:\Windows\system32\sc.exe
  sc query CuckooMon
  2⤵
  - Launches sc.exe
  PID:1524
- C:\Windows\system32\sc.exe
  sc query Joeboxserver
  2⤵
  - Launches sc.exe
  PID:840
- C:\Windows\system32\sc.exe
  sc query cmdvirth
  2⤵
  - Launches sc.exe
  PID:464
- C:\Windows\system32\sc.exe
  sc query SxIn
  2⤵
  - Launches sc.exe
  PID:1224
- C:\Windows\system32\sc.exe
  sc query SAVAdminService
  2⤵
  - Launches sc.exe
  PID:2708
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4908
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:4604