10aacce234ccaa814257bbbfce2af4af46d6d444fe8dd87c3984ccaa9a409270

General

Target
2026-10-22_02370656061cba9f11b36be2cabaae07_coinminer_glassworm_snatch.exe
Size 3.2MB
Sample261024-26xt1acy8w
SHA256 10aacce234ccaa814257bbbfce2af4af46d6d444fe8dd87c3984ccaa9a409270
MD5 02370656061cba9f11b36be2cabaae07
SHA1 ba8084fc213d2978ddf92652bb96fce845646005
SHA512 23f8340909698045d4f1de4a538e05c307da2918b75ce31b4f89531f7594a10a4ddb954186fd314468734a5cad1deb1c12f06dd1fc05dfec3e5bca2e2185d3a6
SSDEEP 49152:uO3Q51J2q1UVxZxvnm7IAQW1MNzW/BTqoAoa:uOkAe8+
TLSH
T132F56A07FCA918F6C2AEE1318966A9527B70BC480B3123D72F50B6782F76BD06D79714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

Identifies Wine through registry keys 2 TTPs 4 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wine	2026-10-22_02370656061cba9f11b36be2cabaae07_coinminer_glassworm_snatch.exe
Key opened	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\SOFTWARE\Wine	2026-10-22_02370656061cba9f11b36be2cabaae07_coinminer_glassworm_snatch.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wine	2026-10-22_02370656061cba9f11b36be2cabaae07_coinminer_glassworm_snatch.exe
Key opened	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\SOFTWARE\Wine	2026-10-22_02370656061cba9f11b36be2cabaae07_coinminer_glassworm_snatch.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefenderTask = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-10-22_02370656061cba9f11b36be2cabaae07_coinminer_glassworm_snatch.exe"	2026-10-22_02370656061cba9f11b36be2cabaae07_coinminer_glassworm_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefenderTask = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-10-22_02370656061cba9f11b36be2cabaae07_coinminer_glassworm_snatch.exe"	2026-10-22_02370656061cba9f11b36be2cabaae07_coinminer_glassworm_snatch.exe

Discovers running processes 1 TTPs 2 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
1904	tasklist.exe
2404	tasklist.exe

Launches sc.exe 12 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3832	sc.exe
4748	sc.exe
5992	sc.exe
1396	sc.exe
5720	sc.exe
2348	sc.exe
4420	sc.exe
5236	sc.exe
5456	sc.exe
4644	sc.exe
4360	sc.exe
4668	sc.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-22_02370656061cba9f11b36be2cabaae07_coinminer_glassworm_snatch.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-22_02370656061cba9f11b36be2cabaae07_coinminer_glassworm_snatch.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1904	tasklist.exe
Token: SeDebugPrivilege	2404	tasklist.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 3556 wrote to memory of 1904	3556	2026-10-22_02370656061cba9f11b36be2cabaae07_coinminer_glassworm_snatch.exe	89
PID 3556 wrote to memory of 5992	3556	2026-10-22_02370656061cba9f11b36be2cabaae07_coinminer_glassworm_snatch.exe	92
PID 3556 wrote to memory of 4360	3556	2026-10-22_02370656061cba9f11b36be2cabaae07_coinminer_glassworm_snatch.exe	94
PID 3556 wrote to memory of 4668	3556	2026-10-22_02370656061cba9f11b36be2cabaae07_coinminer_glassworm_snatch.exe	96
PID 3556 wrote to memory of 1396	3556	2026-10-22_02370656061cba9f11b36be2cabaae07_coinminer_glassworm_snatch.exe	98
PID 3556 wrote to memory of 3832	3556	2026-10-22_02370656061cba9f11b36be2cabaae07_coinminer_glassworm_snatch.exe	100
PID 3556 wrote to memory of 5720	3556	2026-10-22_02370656061cba9f11b36be2cabaae07_coinminer_glassworm_snatch.exe	102
PID 3556 wrote to memory of 1944	3556	2026-10-22_02370656061cba9f11b36be2cabaae07_coinminer_glassworm_snatch.exe	104
PID 1944 wrote to memory of 2880	1944	net.exe	106
PID 1744 wrote to memory of 2404	1744	2026-10-22_02370656061cba9f11b36be2cabaae07_coinminer_glassworm_snatch.exe	109
PID 1744 wrote to memory of 2348	1744	2026-10-22_02370656061cba9f11b36be2cabaae07_coinminer_glassworm_snatch.exe	111
PID 1744 wrote to memory of 4420	1744	2026-10-22_02370656061cba9f11b36be2cabaae07_coinminer_glassworm_snatch.exe	113
PID 1744 wrote to memory of 5236	1744	2026-10-22_02370656061cba9f11b36be2cabaae07_coinminer_glassworm_snatch.exe	115
PID 1744 wrote to memory of 4748	1744	2026-10-22_02370656061cba9f11b36be2cabaae07_coinminer_glassworm_snatch.exe	117
PID 1744 wrote to memory of 5456	1744	2026-10-22_02370656061cba9f11b36be2cabaae07_coinminer_glassworm_snatch.exe	119
PID 1744 wrote to memory of 4644	1744	2026-10-22_02370656061cba9f11b36be2cabaae07_coinminer_glassworm_snatch.exe	121
PID 1744 wrote to memory of 1936	1744	2026-10-22_02370656061cba9f11b36be2cabaae07_coinminer_glassworm_snatch.exe	123
PID 1936 wrote to memory of 4860	1936	net.exe	125

C:\Users\Admin\AppData\Local\Temp\2026-10-22_02370656061cba9f11b36be2cabaae07_coinminer_glassworm_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_02370656061cba9f11b36be2cabaae07_coinminer_glassworm_snatch.exe"
1⤵
- Identifies Wine through registry keys
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:3556
- C:\Windows\system32\tasklist.exe
  tasklist /fo csv /nh
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1904
- C:\Windows\system32\sc.exe
  sc query SbieSvc
  2⤵
  - Launches sc.exe
  PID:5992
- C:\Windows\system32\sc.exe
  sc query CuckooMon
  2⤵
  - Launches sc.exe
  PID:4360
- C:\Windows\system32\sc.exe
  sc query Joeboxserver
  2⤵
  - Launches sc.exe
  PID:4668
- C:\Windows\system32\sc.exe
  sc query cmdvirth
  2⤵
  - Launches sc.exe
  PID:1396
- C:\Windows\system32\sc.exe
  sc query SxIn
  2⤵
  - Launches sc.exe
  PID:3832
- C:\Windows\system32\sc.exe
  sc query SAVAdminService
  2⤵
  - Launches sc.exe
  PID:5720
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1944
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:2880

C:\Users\Admin\AppData\Local\Temp\2026-10-22_02370656061cba9f11b36be2cabaae07_coinminer_glassworm_snatch.exe
C:\Users\Admin\AppData\Local\Temp\2026-10-22_02370656061cba9f11b36be2cabaae07_coinminer_glassworm_snatch.exe
1⤵
- Identifies Wine through registry keys
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Windows\system32\tasklist.exe
  tasklist /fo csv /nh
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2404
- C:\Windows\system32\sc.exe
  sc query SbieSvc
  2⤵
  - Launches sc.exe
  PID:2348
- C:\Windows\system32\sc.exe
  sc query CuckooMon
  2⤵
  - Launches sc.exe
  PID:4420
- C:\Windows\system32\sc.exe
  sc query Joeboxserver
  2⤵
  - Launches sc.exe
  PID:5236
- C:\Windows\system32\sc.exe
  sc query cmdvirth
  2⤵
  - Launches sc.exe
  PID:4748
- C:\Windows\system32\sc.exe
  sc query SxIn
  2⤵
  - Launches sc.exe
  PID:5456
- C:\Windows\system32\sc.exe
  sc query SAVAdminService
  2⤵
  - Launches sc.exe
  PID:4644
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1936
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:4860