94bf29d4131474cf07a8f947b76e613a2aec3a8fbed6468cee04437f6306cead

General

Target
2026-10-22_1b867443db760ed62776b23057f01d2f_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 7.3MB
Sample261024-ytk3wsff95
SHA256 94bf29d4131474cf07a8f947b76e613a2aec3a8fbed6468cee04437f6306cead
MD5 1b867443db760ed62776b23057f01d2f
SHA1 af1571f994d961643c3060577d803e01302974fc
SHA512 f99c81eb8d01f984237da9298cb5c3a0575cd7b166c7c0a391e581b7cbd64d2ab03acab783e948be9a7b661ba74bffb2724fe14dd629e732c92e5aa01f4f0fac
SSDEEP 49152:CMXLUBRGdA3tlPAHJgG/xZSjh5CgxkrPqsiuGUwnulcgzi3MFh3/gVOldeODKVK8:CM7QYabnKwnTvOLDE
TLSH
T163762907FC9619E5C0AE91358A7692127F71BC481B2163D72B50F7283F76BD0AEBA350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery

Malware Config

Signatures

Custom signature

Detects executables referencing combination of virtualization drivers 1 IoCs

resource	yara_rule
behavioral1/files/0x000700000002446b-9.dat	INDICATOR_SUSPICIOUS_VM_Evasion_VirtDrvComb

Custom signature

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
behavioral1/files/0x000700000002446b-9.dat	INDICATOR_SUSPICIOUS_References_SecTools

Executes dropped EXE 1 IoCs

pid	Process
384	DiscordUpdate.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
14	discord.com
15	discord.com

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiscordUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiscordUpdate.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
384	DiscordUpdate.exe
384	DiscordUpdate.exe
384	DiscordUpdate.exe
384	DiscordUpdate.exe
384	DiscordUpdate.exe
384	DiscordUpdate.exe
384	DiscordUpdate.exe
384	DiscordUpdate.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3224	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3224	Explorer.EXE
Token: SeCreatePagefilePrivilege	3224	Explorer.EXE

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 384	2068	2026-10-22_1b867443db760ed62776b23057f01d2f_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	86
PID 384 wrote to memory of 3224	384	DiscordUpdate.exe	55
PID 384 wrote to memory of 3224	384	DiscordUpdate.exe	55
PID 384 wrote to memory of 3224	384	DiscordUpdate.exe	55
PID 384 wrote to memory of 3224	384	DiscordUpdate.exe	55
PID 384 wrote to memory of 3224	384	DiscordUpdate.exe	55
PID 384 wrote to memory of 3224	384	DiscordUpdate.exe	55
PID 384 wrote to memory of 3224	384	DiscordUpdate.exe	55
PID 384 wrote to memory of 3224	384	DiscordUpdate.exe	55
PID 384 wrote to memory of 3224	384	DiscordUpdate.exe	55
PID 384 wrote to memory of 3224	384	DiscordUpdate.exe	55

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3224
- C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b867443db760ed62776b23057f01d2f_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b867443db760ed62776b23057f01d2f_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2068
- - C:\Users\Admin\AppData\Local\Discord\app-1.0.0\DiscordUpdate.exe
    "C:\Users\Admin\AppData\Local\Discord\app-1.0.0\DiscordUpdate.exe"
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DiscordUpdate.exe

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.0\DiscordUpdate.exe
Size 7.3MB
SHA256 94bf29d4131474cf07a8f947b76e613a2aec3a8fbed6468cee04437f6306cead
MD5 1b867443db760ed62776b23057f01d2f
SHA1 af1571f994d961643c3060577d803e01302974fc
SHA512 f99c81eb8d01f984237da9298cb5c3a0575cd7b166c7c0a391e581b7cbd64d2ab03acab783e948be9a7b661ba74bffb2724fe14dd629e732c92e5aa01f4f0fac
SSDEEP 49152:CMXLUBRGdA3tlPAHJgG/xZSjh5CgxkrPqsiuGUwnulcgzi3MFh3/gVOldeODKVK8:CM7QYabnKwnTvOLDE
TLSH
T163762907FC9619E5C0AE91358A7692127F71BC481B2163D72B50F7283F76BD0AEBA350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sentinel_inject.log

Path C:\Users\Admin\AppData\Local\Temp\sentinel_inject.log
Size 1KB
SHA256 62a4e0de9cffb440a428d14bd91e3f87c7784b8f6dd0deda2aea4b31c5b1c0de
MD5 3fc8a14bba3ada4f4659a9bdd4484ec8
SHA1 79ba3c4a13334f3e6850ae9d9917efed45e445ff
SHA512 446379c61cc3035c3e540665bef7ed688d48d468fade0e1c244b7aa8205bad85f00e9e35984677ef6294ce6c2ee3de78cfbd2138d7462aa9cee5f6deb36b83f4
TLSH
T16231561EE222E1D1E24403C4D55F314F809EB62652CD9175BD1A7F12A46F198C5F33B6
MD5 SHA1 SHA512 TLSH

Submit Download

sentinel_main.log

Path C:\Users\Admin\AppData\Local\Temp\sentinel_main.log
Size 615B
SHA256 3964f92d92180747a814ebfc6ff8c7814a9e97d2b78e82c48f1b2dce412370ab
MD5 5199f8ee062d7f793999ff206f3ba60e
SHA1 831c82ced3fce39ad2b379113ba4316b874d84c7
SHA512 ff0f6129be2712f77edf69218d7e67ead5690f47e54e5e918e111d05df3d86817a21f4f2e0a2ed3ac911da078c1fdf2d6d83807e425bb7733c152b2a7700c116
TLSH
T108F0AC0016C0DB7F4A954027CC5FD29729AA2CF90B4A0731E634B59C28632A937E3336
MD5 SHA1 SHA512 TLSH

Submit Download

sentinel_main.log

Path C:\Users\Admin\AppData\Local\Temp\sentinel_main.log
Size 258B
SHA256 d687072cda523f0c2d01ffd1db49918a4365fa23bb68db1783b539f8e6792160
MD5 478e6de9ed12975dddaa0535d3c6edfa
SHA1 33eca4d4eac0e84797b526f66850502afd45c663
SHA512 36b9f83e18895e5cb6335b6a71f697091963d92cc730b4a5799c6fe605aa56f86df6a2a49e5c4f92585c6d017509cfb00c2be0d2c1cd3e0bf2f6777cf789d0a5
TLSH
T19BD02B500680D63E44155023C88FA15718692DFD1B400735C670618C242219736B6270
MD5 SHA1 SHA512 TLSH

Submit Download

sentinel_main.log

Path C:\Users\Admin\AppData\Local\Temp\sentinel_main.log
Size 1KB
SHA256 9fa68adfa3411ffb46227a44d99daaeb7409a3f03f274841fe902318ebcb72ac
MD5 0fdb3403791e8b461cfa8c7115626b73
SHA1 d4f48a97c635477549830d7d4e1e4c9c88447aed
SHA512 09f30a50bd2c22199a375431d42510541a34a6d7742f5e4a0c99879999bbb141251bfceaa163ccbf31a9ea54cd15c388d926f63ac66d0ac5f00330c6b4a171a7
TLSH
T160211E0318BBC7FE06A0E043C44F8B5318211969178A1B34B174A0BD276A16573E3333
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3224-47-0x0000000002F40000-0x0000000002F41000-memory.dmp

Download

memory/3224-54-0x0000000002F40000-0x0000000002F41000-memory.dmp

Download

memory/3224-60-0x00000000010F0000-0x00000000010F1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads