4fe46ca568020c1f84ba4cc28999b72ef674eb95fb61bb24628539e63370b427

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 07:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_7f96e7af113b5ba61998d1179d67a583_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 7.4MB
Sample261024-h1za4aee32
SHA256 4fe46ca568020c1f84ba4cc28999b72ef674eb95fb61bb24628539e63370b427
MD5 7f96e7af113b5ba61998d1179d67a583
SHA1 c364dda281558d10084f974f28a284106456ab9c
SHA512 37a96002798a594442937981975d834162d3ee31e78f2f9f315b2980515f03faaba702075e982450d9dbb70ac1e3953c6106f42d33f3eb6b62c6fd00aa19f220
SSDEEP 49152:+pKo+iuuyQ0s2tKptFBU9Z4UYeYHb1C7fn3JX2/bRj2I5Xmo0j929UUYBKQK1Ksi:+pJhpX2tqy5NyLUb0GcE9
TLSH
T1D9764A43EC6514E9C1ADD63489B69253BB717C880B3263D72B90F2387E72BD06D7A394
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution persistence privilege_escalation

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Proxy Network.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Proxy Network.lnk	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
6140	server-remote.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5196	powershell.exe
1780	powershell.exe

GoLang User-Agent 2 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	7	Go-http-client/1.1
HTTP User-Agent header	10	Go-http-client/1.1

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1780	powershell.exe
1780	powershell.exe
5196	powershell.exe
5196	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1780	powershell.exe
Token: SeDebugPrivilege	5196	powershell.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
6140	server-remote.exe
6140	server-remote.exe
6140	server-remote.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
6140	server-remote.exe
6140	server-remote.exe
6140	server-remote.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3084 wrote to memory of 4236	3084	2026-10-22_7f96e7af113b5ba61998d1179d67a583_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	89
PID 3084 wrote to memory of 1780	3084	2026-10-22_7f96e7af113b5ba61998d1179d67a583_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	91
PID 3084 wrote to memory of 6140	3084	2026-10-22_7f96e7af113b5ba61998d1179d67a583_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	93
PID 6140 wrote to memory of 780	6140	server-remote.exe	94
PID 6140 wrote to memory of 5196	6140	server-remote.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-10-22_7f96e7af113b5ba61998d1179d67a583_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7f96e7af113b5ba61998d1179d67a583_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3084
- C:\Windows\system32\schtasks.exe
  schtasks /Delete /TN "ProxyNetwork Watchdog" /F
  2⤵
  PID:4236
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "$s = New-Object -ComObject WScript.Shell; $sc = $s.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Proxy Network.lnk'); $sc.TargetPath = 'C:\Users\Admin\AppData\Local\ProxyNetwork\server-remote.exe'; $sc.WorkingDirectory = 'C:\Users\Admin\AppData\Local\ProxyNetwork'; $sc.Description = 'Proxy Network bandwidth provider'; $sc.Save()"
  2⤵
  - Creates a file in the Startup directory
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1780
- C:\Users\Admin\AppData\Local\ProxyNetwork\server-remote.exe
  C:\Users\Admin\AppData\Local\ProxyNetwork\server-remote.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:6140
- - C:\Windows\system32\schtasks.exe
    schtasks /Delete /TN "ProxyNetwork Watchdog" /F
    3⤵
    PID:780
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "$s = New-Object -ComObject WScript.Shell; $sc = $s.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Proxy Network.lnk'); $sc.TargetPath = 'C:\Users\Admin\AppData\Local\ProxyNetwork\server-remote.exe'; $sc.WorkingDirectory = 'C:\Users\Admin\AppData\Local\ProxyNetwork'; $sc.Description = 'Proxy Network bandwidth provider'; $sc.Save()"
    3⤵
    - Creates a file in the Startup directory
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5196

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 452eb598b2884fd99242cb5db005e3ac8e31bc9e3d58fe88ad0dd79ba08fbfd1
MD5 33f7a6fe6a1ea0bc7232e4b50743aaab
SHA1 f6389fac11178ade648f5f722858ade7790e8676
SHA512 64fed57e8e59a8d4c52029e5b9a9e95959a860dd2b01f96eda9e0484d0ae4572a4759db8892bacc9ddc3f3b2def74d2f9da00853aedc08b55520c731ed45658a
TLSH
T12C115733F3CC8724DC9A413650CEAC1136B687DB409ECE6BBB84D548B42F299DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

server-remote.exe

Path C:\Users\Admin\AppData\Local\ProxyNetwork\server-remote.exe
Size 7.4MB
SHA256 4fe46ca568020c1f84ba4cc28999b72ef674eb95fb61bb24628539e63370b427
MD5 7f96e7af113b5ba61998d1179d67a583
SHA1 c364dda281558d10084f974f28a284106456ab9c
SHA512 37a96002798a594442937981975d834162d3ee31e78f2f9f315b2980515f03faaba702075e982450d9dbb70ac1e3953c6106f42d33f3eb6b62c6fd00aa19f220
SSDEEP 49152:+pKo+iuuyQ0s2tKptFBU9Z4UYeYHb1C7fn3JX2/bRj2I5Xmo0j929UUYBKQK1Ksi:+pJhpX2tqy5NyLUb0GcE9
TLSH
T1D9764A43EC6514E9C1ADD63489B69253BB717C880B3263D72B90F2387E72BD06D7A394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_yrfbtnob.hfg.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yrfbtnob.hfg.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

Proxy Network.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Proxy Network.lnk
Size 1KB
SHA256 5c89e97254944b10f6be5a32424b6177843f943b105f2c7119dbd20444fb55fa
MD5 2c848d9d1b998a432dc420194cb0e1b9
SHA1 359afd8c09872b74270f6d2fc8caebf50deeb749
SHA512 3901bfa2e253ce13c4c7a5d23e0000f67a77a882ab99fca74c3d3a10766a21b81cabc6bcb7fdb0cfd91e12b62cafcdf130d9896be44b9788770cc92baad7b054
TLSH
T1AC210D075BC62F56E3FA813282F76A65827B3C66F2814F0E10C162982C316414AC4F8F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1780-9-0x00007FFF40D30000-0x00007FFF416D4000-memory.dmp

Download

memory/1780-8-0x00007FFF40D30000-0x00007FFF416D4000-memory.dmp

Download

memory/1780-1-0x00007FFF40EBF000-0x00007FFF40EC0000-memory.dmp

Download

memory/1780-10-0x00007FFF40D30000-0x00007FFF416D4000-memory.dmp

Download

memory/1780-7-0x00007FFF40D30000-0x00007FFF416D4000-memory.dmp

Download

memory/1780-14-0x00007FFF40D30000-0x00007FFF416D4000-memory.dmp

Download

memory/1780-15-0x00007FFF40D30000-0x00007FFF416D4000-memory.dmp

Download

memory/1780-16-0x00007FFF40D30000-0x00007FFF416D4000-memory.dmp

Download

memory/1780-6-0x0000018C27B70000-0x0000018C27B92000-memory.dmp

Download

memory/1780-5-0x00007FFF40D30000-0x00007FFF416D4000-memory.dmp

Download

memory/1780-2-0x00007FFF40D30000-0x00007FFF416D4000-memory.dmp

Download