bf4754b9b4341217f7b1c9462cd0b371a68eb31cde0b207eb87828c5c1bb5d0a

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemCache\\WmiProvider.exe\""	reg.exe

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c50f-4.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c50f-4.dat	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Executes dropped EXE 3 IoCs

pid	Process
4196	WmiProvider.exe
3008	WmiProvider.exe
5452	WmiProvider.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsComponentHost = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemCache\\WmiProvider.exe\""	reg.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-22_3d3eed8148e3659d15ebfe7f650a5d27_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-22_3d3eed8148e3659d15ebfe7f650a5d27_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiProvider.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiProvider.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

pid	Process
4780	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
3148	schtasks.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4400 wrote to memory of 4780	4400	2026-10-22_3d3eed8148e3659d15ebfe7f650a5d27_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	89
PID 4400 wrote to memory of 3148	4400	2026-10-22_3d3eed8148e3659d15ebfe7f650a5d27_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	91
PID 4400 wrote to memory of 5036	4400	2026-10-22_3d3eed8148e3659d15ebfe7f650a5d27_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	93
PID 4400 wrote to memory of 4196	4400	2026-10-22_3d3eed8148e3659d15ebfe7f650a5d27_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-10-22_3d3eed8148e3659d15ebfe7f650a5d27_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_3d3eed8148e3659d15ebfe7f650a5d27_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsComponentHost /t REG_SZ /d \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemCache\WmiProvider.exe\" /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:4780
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftWindowsCacheMgr /xml C:\Users\Admin\AppData\Local\Temp\wcm.xml /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3148
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Userinit /t REG_SZ /d C:\Windows\system32\userinit.exe,\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemCache\WmiProvider.exe\" /f
  2⤵
  - Modifies WinLogon for persistence
  PID:5036
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemCache\WmiProvider.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemCache\WmiProvider.exe somedude-56621.portmap.host:56621
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  PID:4196

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemCache\WmiProvider.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemCache\WmiProvider.exe"
1⤵
- Executes dropped EXE
PID:3008

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemCache\WmiProvider.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemCache\WmiProvider.exe
1⤵
- Executes dropped EXE
PID:5452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Modify Registry

3

Credential Access

Discovery

Query Registry

T1012

System Network Configuration Discovery