c9b0642b35fa957c16d18f142e77759eb19ca3ec57200a5cac35c3d7a6ff891f

General

Target
2026-10-22_a3dcec52fae9bfedb5bfc9ece15f86c0_coinminer_glassworm_snatch.exe
Size 3.2MB
Sample261024-ckph3a1zfx
SHA256 c9b0642b35fa957c16d18f142e77759eb19ca3ec57200a5cac35c3d7a6ff891f
MD5 a3dcec52fae9bfedb5bfc9ece15f86c0
SHA1 0dc6769d5fbf85d767c3ac84d41f02e0613e3ab8
SHA512 e1caa1051b08c86b8d05bc48abfd3a84ba39dc1f399bf329f9379df3df4b9c078c9babddeacc94c61881ba230e5025ec29f56bb3cb70fc40b190323779dec55a
SSDEEP 49152:uO3Q51J2q1UVxZxvnm7IAQW1MNzW/BTqvAoa:uOkAe8+
TLSH
T12BF56A07FCA918F6C2AEE1318966A9527B70BC480B3123D72F50B6782F76BD06D79714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

Identifies Wine through registry keys 2 TTPs 4 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wine	2026-10-22_a3dcec52fae9bfedb5bfc9ece15f86c0_coinminer_glassworm_snatch.exe
Key opened	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\SOFTWARE\Wine	2026-10-22_a3dcec52fae9bfedb5bfc9ece15f86c0_coinminer_glassworm_snatch.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wine	2026-10-22_a3dcec52fae9bfedb5bfc9ece15f86c0_coinminer_glassworm_snatch.exe
Key opened	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\SOFTWARE\Wine	2026-10-22_a3dcec52fae9bfedb5bfc9ece15f86c0_coinminer_glassworm_snatch.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefenderTask = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-10-22_a3dcec52fae9bfedb5bfc9ece15f86c0_coinminer_glassworm_snatch.exe"	2026-10-22_a3dcec52fae9bfedb5bfc9ece15f86c0_coinminer_glassworm_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefenderTask = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-10-22_a3dcec52fae9bfedb5bfc9ece15f86c0_coinminer_glassworm_snatch.exe"	2026-10-22_a3dcec52fae9bfedb5bfc9ece15f86c0_coinminer_glassworm_snatch.exe

Discovers running processes 1 TTPs 2 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
3328	tasklist.exe
1512	tasklist.exe

Launches sc.exe 12 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1600	sc.exe
5048	sc.exe
5816	sc.exe
3372	sc.exe
1988	sc.exe
3964	sc.exe
5220	sc.exe
2708	sc.exe
3712	sc.exe
6140	sc.exe
2832	sc.exe
4252	sc.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-22_a3dcec52fae9bfedb5bfc9ece15f86c0_coinminer_glassworm_snatch.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-22_a3dcec52fae9bfedb5bfc9ece15f86c0_coinminer_glassworm_snatch.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3328	tasklist.exe
Token: SeDebugPrivilege	1512	tasklist.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 3328	2488	2026-10-22_a3dcec52fae9bfedb5bfc9ece15f86c0_coinminer_glassworm_snatch.exe	89
PID 2488 wrote to memory of 1600	2488	2026-10-22_a3dcec52fae9bfedb5bfc9ece15f86c0_coinminer_glassworm_snatch.exe	92
PID 2488 wrote to memory of 5048	2488	2026-10-22_a3dcec52fae9bfedb5bfc9ece15f86c0_coinminer_glassworm_snatch.exe	94
PID 2488 wrote to memory of 3712	2488	2026-10-22_a3dcec52fae9bfedb5bfc9ece15f86c0_coinminer_glassworm_snatch.exe	96
PID 2488 wrote to memory of 5816	2488	2026-10-22_a3dcec52fae9bfedb5bfc9ece15f86c0_coinminer_glassworm_snatch.exe	98
PID 2488 wrote to memory of 3372	2488	2026-10-22_a3dcec52fae9bfedb5bfc9ece15f86c0_coinminer_glassworm_snatch.exe	100
PID 2488 wrote to memory of 1988	2488	2026-10-22_a3dcec52fae9bfedb5bfc9ece15f86c0_coinminer_glassworm_snatch.exe	102
PID 2488 wrote to memory of 1092	2488	2026-10-22_a3dcec52fae9bfedb5bfc9ece15f86c0_coinminer_glassworm_snatch.exe	104
PID 1092 wrote to memory of 3836	1092	net.exe	106
PID 5268 wrote to memory of 1512	5268	2026-10-22_a3dcec52fae9bfedb5bfc9ece15f86c0_coinminer_glassworm_snatch.exe	109
PID 5268 wrote to memory of 6140	5268	2026-10-22_a3dcec52fae9bfedb5bfc9ece15f86c0_coinminer_glassworm_snatch.exe	111
PID 5268 wrote to memory of 3964	5268	2026-10-22_a3dcec52fae9bfedb5bfc9ece15f86c0_coinminer_glassworm_snatch.exe	113
PID 5268 wrote to memory of 5220	5268	2026-10-22_a3dcec52fae9bfedb5bfc9ece15f86c0_coinminer_glassworm_snatch.exe	115
PID 5268 wrote to memory of 2832	5268	2026-10-22_a3dcec52fae9bfedb5bfc9ece15f86c0_coinminer_glassworm_snatch.exe	117
PID 5268 wrote to memory of 2708	5268	2026-10-22_a3dcec52fae9bfedb5bfc9ece15f86c0_coinminer_glassworm_snatch.exe	119
PID 5268 wrote to memory of 4252	5268	2026-10-22_a3dcec52fae9bfedb5bfc9ece15f86c0_coinminer_glassworm_snatch.exe	121
PID 5268 wrote to memory of 5792	5268	2026-10-22_a3dcec52fae9bfedb5bfc9ece15f86c0_coinminer_glassworm_snatch.exe	123
PID 5792 wrote to memory of 452	5792	net.exe	125

C:\Users\Admin\AppData\Local\Temp\2026-10-22_a3dcec52fae9bfedb5bfc9ece15f86c0_coinminer_glassworm_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_a3dcec52fae9bfedb5bfc9ece15f86c0_coinminer_glassworm_snatch.exe"
1⤵
- Identifies Wine through registry keys
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Windows\system32\tasklist.exe
  tasklist /fo csv /nh
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3328
- C:\Windows\system32\sc.exe
  sc query SbieSvc
  2⤵
  - Launches sc.exe
  PID:1600
- C:\Windows\system32\sc.exe
  sc query CuckooMon
  2⤵
  - Launches sc.exe
  PID:5048
- C:\Windows\system32\sc.exe
  sc query Joeboxserver
  2⤵
  - Launches sc.exe
  PID:3712
- C:\Windows\system32\sc.exe
  sc query cmdvirth
  2⤵
  - Launches sc.exe
  PID:5816
- C:\Windows\system32\sc.exe
  sc query SxIn
  2⤵
  - Launches sc.exe
  PID:3372
- C:\Windows\system32\sc.exe
  sc query SAVAdminService
  2⤵
  - Launches sc.exe
  PID:1988
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1092
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:3836

C:\Users\Admin\AppData\Local\Temp\2026-10-22_a3dcec52fae9bfedb5bfc9ece15f86c0_coinminer_glassworm_snatch.exe
C:\Users\Admin\AppData\Local\Temp\2026-10-22_a3dcec52fae9bfedb5bfc9ece15f86c0_coinminer_glassworm_snatch.exe
1⤵
- Identifies Wine through registry keys
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:5268
- C:\Windows\system32\tasklist.exe
  tasklist /fo csv /nh
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1512
- C:\Windows\system32\sc.exe
  sc query SbieSvc
  2⤵
  - Launches sc.exe
  PID:6140
- C:\Windows\system32\sc.exe
  sc query CuckooMon
  2⤵
  - Launches sc.exe
  PID:3964
- C:\Windows\system32\sc.exe
  sc query Joeboxserver
  2⤵
  - Launches sc.exe
  PID:5220
- C:\Windows\system32\sc.exe
  sc query cmdvirth
  2⤵
  - Launches sc.exe
  PID:2832
- C:\Windows\system32\sc.exe
  sc query SxIn
  2⤵
  - Launches sc.exe
  PID:2708
- C:\Windows\system32\sc.exe
  sc query SAVAdminService
  2⤵
  - Launches sc.exe
  PID:4252
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5792
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:452