Analysis
- max time kernel
150s - max time network
31s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/10/2026, 20:04
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-10-22_1b867443db760ed62776b23057f01d2f_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-22_1b867443db760ed62776b23057f01d2f_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-10-22_1b867443db760ed62776b23057f01d2f_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
- Size 7.3MB
- Sample261024-ytk3wsff95
- SHA256 94bf29d4131474cf07a8f947b76e613a2aec3a8fbed6468cee04437f6306cead
- MD5 1b867443db760ed62776b23057f01d2f
- SHA1 af1571f994d961643c3060577d803e01302974fc
- SHA512 f99c81eb8d01f984237da9298cb5c3a0575cd7b166c7c0a391e581b7cbd64d2ab03acab783e948be9a7b661ba74bffb2724fe14dd629e732c92e5aa01f4f0fac
- SSDEEP 49152:CMXLUBRGdA3tlPAHJgG/xZSjh5CgxkrPqsiuGUwnulcgzi3MFh3/gVOldeODKVK8:CM7QYabnKwnTvOLDE
- TLSH T163762907FC9619E5C0AE91358A7692127F71BC481B2163D72B50F7283F76BD0AEBA350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables referencing combination of virtualization drivers 1 IoCs
resource yara_rule behavioral2/files/0x000d00000001c519-9.dat INDICATOR_SUSPICIOUS_VM_Evasion_VirtDrvComb - Detects executables referencing many IR and analysis tools 1 IoCs
resource yara_rule behavioral2/files/0x000d00000001c519-9.dat INDICATOR_SUSPICIOUS_References_SecTools - Executes dropped EXE 1 IoCs
pid Process 2752 DiscordUpdate.exe - Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 1 discord.com 2 discord.com - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname DiscordUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain DiscordUpdate.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2752 DiscordUpdate.exe 2752 DiscordUpdate.exe 2752 DiscordUpdate.exe 2752 DiscordUpdate.exe 2752 DiscordUpdate.exe 2752 DiscordUpdate.exe 2752 DiscordUpdate.exe 2752 DiscordUpdate.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 572 explorer.exe - Suspicious use of AdjustPrivilegeToken 32 IoCs
description pid Process Token: SeShutdownPrivilege 572 explorer.exe Token: SeCreatePagefilePrivilege 572 explorer.exe Token: SeShutdownPrivilege 572 explorer.exe Token: SeCreatePagefilePrivilege 572 explorer.exe Token: SeShutdownPrivilege 572 explorer.exe Token: SeCreatePagefilePrivilege 572 explorer.exe Token: SeShutdownPrivilege 572 explorer.exe Token: SeCreatePagefilePrivilege 572 explorer.exe Token: SeShutdownPrivilege 572 explorer.exe Token: SeCreatePagefilePrivilege 572 explorer.exe Token: SeShutdownPrivilege 572 explorer.exe Token: SeCreatePagefilePrivilege 572 explorer.exe Token: SeShutdownPrivilege 572 explorer.exe Token: SeCreatePagefilePrivilege 572 explorer.exe Token: SeShutdownPrivilege 572 explorer.exe Token: SeCreatePagefilePrivilege 572 explorer.exe Token: SeShutdownPrivilege 572 explorer.exe Token: SeCreatePagefilePrivilege 572 explorer.exe Token: SeShutdownPrivilege 572 explorer.exe Token: SeCreatePagefilePrivilege 572 explorer.exe Token: SeShutdownPrivilege 572 explorer.exe Token: SeCreatePagefilePrivilege 572 explorer.exe Token: SeShutdownPrivilege 572 explorer.exe Token: SeCreatePagefilePrivilege 572 explorer.exe Token: SeShutdownPrivilege 572 explorer.exe Token: SeCreatePagefilePrivilege 572 explorer.exe Token: SeShutdownPrivilege 572 explorer.exe Token: SeCreatePagefilePrivilege 572 explorer.exe Token: SeShutdownPrivilege 572 explorer.exe Token: SeCreatePagefilePrivilege 572 explorer.exe Token: SeShutdownPrivilege 572 explorer.exe Token: SeCreatePagefilePrivilege 572 explorer.exe - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1312 wrote to memory of 2752 1312 2026-10-22_1b867443db760ed62776b23057f01d2f_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 89 PID 2752 wrote to memory of 572 2752 DiscordUpdate.exe 81 PID 2752 wrote to memory of 572 2752 DiscordUpdate.exe 81 PID 2752 wrote to memory of 572 2752 DiscordUpdate.exe 81 PID 2752 wrote to memory of 572 2752 DiscordUpdate.exe 81 PID 2752 wrote to memory of 572 2752 DiscordUpdate.exe 81 PID 2752 wrote to memory of 572 2752 DiscordUpdate.exe 81 PID 2752 wrote to memory of 572 2752 DiscordUpdate.exe 81 PID 2752 wrote to memory of 572 2752 DiscordUpdate.exe 81 PID 2752 wrote to memory of 572 2752 DiscordUpdate.exe 81 PID 2752 wrote to memory of 572 2752 DiscordUpdate.exe 81
Processes
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:572 -
C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b867443db760ed62776b23057f01d2f_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b867443db760ed62776b23057f01d2f_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Users\Admin\AppData\Local\Discord\app-1.0.0\DiscordUpdate.exe"C:\Users\Admin\AppData\Local\Discord\app-1.0.0\DiscordUpdate.exe"3⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2752
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:1520
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Discord\app-1.0.0\DiscordUpdate.exe
- Size 7.3MB
- SHA256 94bf29d4131474cf07a8f947b76e613a2aec3a8fbed6468cee04437f6306cead
- MD5 1b867443db760ed62776b23057f01d2f
- SHA1 af1571f994d961643c3060577d803e01302974fc
- SHA512 f99c81eb8d01f984237da9298cb5c3a0575cd7b166c7c0a391e581b7cbd64d2ab03acab783e948be9a7b661ba74bffb2724fe14dd629e732c92e5aa01f4f0fac
- SSDEEP 49152:CMXLUBRGdA3tlPAHJgG/xZSjh5CgxkrPqsiuGUwnulcgzi3MFh3/gVOldeODKVK8:CM7QYabnKwnTvOLDE
- TLSH T163762907FC9619E5C0AE91358A7692127F71BC481B2163D72B50F7283F76BD0AEBA350
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\sentinel_inject.log
- Size 765B
- SHA256 3c478f24c3e910bae4187234ec081e1ee32445af88a94724e7fab769e3823df4
- MD5 bf39ad190a8ad55f2b388c74c35597e8
- SHA1 f8aa2e96377504f24f3089a35f67be2fcbf39af9
- SHA512 122d91ecb400ee857b8c08acbfe7ce0ce33347dc54c213017c47184edd9097709bc1a67c1a8b49c27c29f3f5a6f429de507c9d4283ef12f484ffc8a936fda67a
- TLSH T115018932A336F1E0906443C6E96A048F00DEF979494E91B02D223776185F5FCD2E373A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\sentinel_inject.log
- Size 1KB
- SHA256 052637c689a9a53ed833002b741f154c42d5dd1d5384c2e6f96855810d6cf86f
- MD5 cf550061f1c74e1b47df3bebdf21586d
- SHA1 b351bc63d65d0a8e3591bc1cc2e83ffe475994aa
- SHA512 6766704d1b58015cf0ab1328e578fb2f552b0b6778924c1ee9d62fb4f4950f9aabdca76ec5cd26228d4e94c697d61806a798af2f6dabb5a7a6c8e1ac91883442
- TLSH T1D5317921A262E1E5E4640382E85F700FC04DB63659CDD575BE1A37A2AC2F5ECD5E333A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\sentinel_inject.log
- Size 1KB
- SHA256 effcf2596467071510df056426232b846e6b63f02f6f68297ad34ecdd70f1d1b
- MD5 96fe1fb243df99b42966b0ed92823195
- SHA1 310d7f0fded210b77a5108c6b399b2b26ae9f926
- SHA512 2a3d7540f018fa6f6d1d01c66b62680fa0c17463a8733c807ce615753cdf7adc6383fcfa0d3800c4cb23c58d2ffdc268576f1db4b064b097b5cacaafa448c7fc
- TLSH T12C31BB22A266E1F5E5680382E46F300F808EF63515CC9575BD1A3751A82F0ECD5E3339
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\sentinel_main.log
- Size 615B
- SHA256 c68b0dc015b2793986e898abececfefe08c96c10a412a3797ef256183c28853f
- MD5 aeea8c3012e8bbfafb48267252a558fb
- SHA1 a7905fffba3c01617539ad0a3b2249393fd672f8
- SHA512 69bdfb0f457db30177140c9a5f88e5a7fca17dd0f8074d5b9e3d3d8a65bfaa4ef6e38fea0999e70bd55a04f232fdb241056f9a87d59ff045838738d9aaff05e5
- TLSH T108F0AC0026C4EB7C5A944027C05FD6D72DAA2DFA1B491730E674B48C28632A933E3F36
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\sentinel_main.log
- Size 258B
- SHA256 0ecb396d66e898169e249f9f6d3ec1bf9998af635cf6f6c9e3a34df380f9f95e
- MD5 09442dc181282dca385f0139617fc6b0
- SHA1 312d667c1e70d0398b1ea9623de32fee6da142eb
- SHA512 0bf7d4265f27519858deaa040d936f6ac84fb98a562ce0cd8f1e69e5741f40559bf604548916ddd568bc6dbb8c04ae0cf1e1e0166a804df8cf059c13637519ae
- TLSH T187D02B500680E62C55155022C08FA5D71C692AFE2B400635C671618C24221973676670
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\sentinel_main.log
- Size 923B
- SHA256 6b21835b6ec4f619952a312f9710bc7fc399514acc3d435c792c17be222f1855
- MD5 6a92acee672f391a4e35534e200413a7
- SHA1 17b9768cdfaafb3458a30cef160ae3b80a53c9b4
- SHA512 81ba52f909ab7ecb29597cb02ce8325d6cf26969edd021eece81cf24802e193bcb108b1588aa6067c822e91e13dcbaff3984205e4edff0b76ef7dd0de2941e3a
- TLSH T19B1123002DA0E7EC5BA44017C04ED7C35C662AB917492670F9F0B48C346366A33F3B7A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\sentinel_main.log
- Size 1KB
- SHA256 04d546d933b76b6cb18e0cee6cd71c42d7cb0fc1aefe8778291c6a3aadc8d3ad
- MD5 c29ecb3894b1a7093dc43a28459caa51
- SHA1 bf3e612e35643f12beaf1f8dff8e8533054cbc73
- SHA512 b3d8ffd5c214a4e593540cdb720006ff2db8fbd280c0651bdb501639c1d00d152662da0af1f8140f693a2fcd7ce014ebe4b02b6a908a05613500482ae1d03fcd
- TLSH T1E421EE001DB4D6EC8BA44057C04E87D35C651ABA274959B0F6F4A44D342266A73E377B
- MD5 SHA1 SHA512 TLSH