Analysis
- max time kernel
149s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
26/10/2026, 17:28
Static task
static1
8 signatures
Behavioral task
behavioral1
Sample
2026-10-25_a41b81849c0af374e2d158e7825e8bd6_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
15 signatures
150 seconds
General
- Target 2026-10-25_a41b81849c0af374e2d158e7825e8bd6_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
- Size 14.6MB
- Sample261026-v1237sgt3l
- SHA256 ba3856166562e20cba448552cc29f000011322c6a03b8458284da5e93c1ba8aa
- MD5 a41b81849c0af374e2d158e7825e8bd6
- SHA1 464ac7f136f7f12dd21bb165b2a03cfc30d33d20
- SHA512 44d66d86878621799962e3d72e1d1cf73e59bc44e8390dd6b18a105e3bb6379be92d68314748d358153d1bfc2aec03cd6796a789839281bcc5c36e7e83451bce
- SSDEEP 98304:VYvQR3DU1ISRDjE8suXgNBADCW6G8PXtXZot+7yOaJ4puEfsk:sheS9jEDBqCtGu7oKpLfsk
- TLSH T155F6D5C2BAD9D0B6C0AD9334C56A92536A39FC44CB2797D71660BE342F327D0697D30A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
resource yara_rule behavioral1/files/0x000c000000021467-2.dat INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs - Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
resource yara_rule behavioral1/files/0x000c000000021467-2.dat INDICATOR_SUSPICIOUS_Binary_References_Browsers - Detects executables Discord URL observed in first stage droppers 1 IoCs
resource yara_rule behavioral1/files/0x000c000000021467-2.dat INDICATOR_SUSPICIOUS_EXE_DiscordURL - Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
resource yara_rule behavioral1/files/0x000c000000021467-2.dat INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore - Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral1/files/0x000c000000021467-2.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables containing possible sandbox system UUIDs 1 IoCs
resource yara_rule behavioral1/files/0x000c000000021467-2.dat INDICATOR_SUSPICIOUS_EXE_SandboxSystemUUIDs - Detects executables referencing virtualization MAC addresses 1 IoCs
resource yara_rule behavioral1/files/0x000c000000021467-2.dat INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb - Executes dropped EXE 1 IoCs
pid Process 3848 RtAudioSvc.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RtAudioSvc = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\RtAudioSvc.exe" 2026-10-25_a41b81849c0af374e2d158e7825e8bd6_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe - Looks up external IP address via web service 1 TTPs 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 11 ip-api.com 13 api.ipify.org 5 api.ipify.org 6 api.ipify.org - Queries system WMI classes for hardware identifiers 2 TTPs 2 IoCs
Uses WMI to read hardware serial numbers or the system UUID, commonly used to fingerprint the victim machine.
pid Process 4280 wmic.exe 3976 wmic.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 2026-10-25_a41b81849c0af374e2d158e7825e8bd6_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain RtAudioSvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 2026-10-25_a41b81849c0af374e2d158e7825e8bd6_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname RtAudioSvc.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5036 2026-10-25_a41b81849c0af374e2d158e7825e8bd6_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe Token: SeIncreaseQuotaPrivilege 4280 wmic.exe Token: SeSecurityPrivilege 4280 wmic.exe Token: SeTakeOwnershipPrivilege 4280 wmic.exe Token: SeLoadDriverPrivilege 4280 wmic.exe Token: SeSystemProfilePrivilege 4280 wmic.exe Token: SeSystemtimePrivilege 4280 wmic.exe Token: SeProfSingleProcessPrivilege 4280 wmic.exe Token: SeIncBasePriorityPrivilege 4280 wmic.exe Token: SeCreatePagefilePrivilege 4280 wmic.exe Token: SeBackupPrivilege 4280 wmic.exe Token: SeRestorePrivilege 4280 wmic.exe Token: SeShutdownPrivilege 4280 wmic.exe Token: SeDebugPrivilege 4280 wmic.exe Token: SeSystemEnvironmentPrivilege 4280 wmic.exe Token: SeRemoteShutdownPrivilege 4280 wmic.exe Token: SeUndockPrivilege 4280 wmic.exe Token: SeManageVolumePrivilege 4280 wmic.exe Token: 33 4280 wmic.exe Token: 34 4280 wmic.exe Token: 35 4280 wmic.exe Token: 36 4280 wmic.exe Token: SeIncreaseQuotaPrivilege 4280 wmic.exe Token: SeSecurityPrivilege 4280 wmic.exe Token: SeTakeOwnershipPrivilege 4280 wmic.exe Token: SeLoadDriverPrivilege 4280 wmic.exe Token: SeSystemProfilePrivilege 4280 wmic.exe Token: SeSystemtimePrivilege 4280 wmic.exe Token: SeProfSingleProcessPrivilege 4280 wmic.exe Token: SeIncBasePriorityPrivilege 4280 wmic.exe Token: SeCreatePagefilePrivilege 4280 wmic.exe Token: SeBackupPrivilege 4280 wmic.exe Token: SeRestorePrivilege 4280 wmic.exe Token: SeShutdownPrivilege 4280 wmic.exe Token: SeDebugPrivilege 4280 wmic.exe Token: SeSystemEnvironmentPrivilege 4280 wmic.exe Token: SeRemoteShutdownPrivilege 4280 wmic.exe Token: SeUndockPrivilege 4280 wmic.exe Token: SeManageVolumePrivilege 4280 wmic.exe Token: 33 4280 wmic.exe Token: 34 4280 wmic.exe Token: 35 4280 wmic.exe Token: 36 4280 wmic.exe Token: SeDebugPrivilege 3848 RtAudioSvc.exe Token: SeIncreaseQuotaPrivilege 3976 wmic.exe Token: SeSecurityPrivilege 3976 wmic.exe Token: SeTakeOwnershipPrivilege 3976 wmic.exe Token: SeLoadDriverPrivilege 3976 wmic.exe Token: SeSystemProfilePrivilege 3976 wmic.exe Token: SeSystemtimePrivilege 3976 wmic.exe Token: SeProfSingleProcessPrivilege 3976 wmic.exe Token: SeIncBasePriorityPrivilege 3976 wmic.exe Token: SeCreatePagefilePrivilege 3976 wmic.exe Token: SeBackupPrivilege 3976 wmic.exe Token: SeRestorePrivilege 3976 wmic.exe Token: SeShutdownPrivilege 3976 wmic.exe Token: SeDebugPrivilege 3976 wmic.exe Token: SeSystemEnvironmentPrivilege 3976 wmic.exe Token: SeRemoteShutdownPrivilege 3976 wmic.exe Token: SeUndockPrivilege 3976 wmic.exe Token: SeManageVolumePrivilege 3976 wmic.exe Token: 33 3976 wmic.exe Token: 34 3976 wmic.exe Token: 35 3976 wmic.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 5036 wrote to memory of 1088 5036 2026-10-25_a41b81849c0af374e2d158e7825e8bd6_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe 85 PID 5036 wrote to memory of 2880 5036 2026-10-25_a41b81849c0af374e2d158e7825e8bd6_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe 87 PID 5036 wrote to memory of 4280 5036 2026-10-25_a41b81849c0af374e2d158e7825e8bd6_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe 89 PID 3848 wrote to memory of 748 3848 RtAudioSvc.exe 94 PID 3848 wrote to memory of 3976 3848 RtAudioSvc.exe 96 - Views/modifies file attributes 1 TTPs 3 IoCs
pid Process 1088 attrib.exe 2880 attrib.exe 748 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-25_a41b81849c0af374e2d158e7825e8bd6_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-25_a41b81849c0af374e2d158e7825e8bd6_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe"1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Local\Temp\2026-10-25_a41b81849c0af374e2d158e7825e8bd6_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe2⤵
- Views/modifies file attributes
PID:1088
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\RtAudioSvc.exe2⤵
- Views/modifies file attributes
PID:2880
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get UUID2⤵
- Queries system WMI classes for hardware identifiers
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:4280
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\RtAudioSvc.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\RtAudioSvc.exe1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\RtAudioSvc.exe2⤵
- Views/modifies file attributes
PID:748
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get UUID2⤵
- Queries system WMI classes for hardware identifiers
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:3976
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Protect\RtAudioSvc.exe
- Size 14.6MB
- SHA256 ba3856166562e20cba448552cc29f000011322c6a03b8458284da5e93c1ba8aa
- MD5 a41b81849c0af374e2d158e7825e8bd6
- SHA1 464ac7f136f7f12dd21bb165b2a03cfc30d33d20
- SHA512 44d66d86878621799962e3d72e1d1cf73e59bc44e8390dd6b18a105e3bb6379be92d68314748d358153d1bfc2aec03cd6796a789839281bcc5c36e7e83451bce
- SSDEEP 98304:VYvQR3DU1ISRDjE8suXgNBADCW6G8PXtXZot+7yOaJ4puEfsk:sheS9jEDBqCtGu7oKpLfsk
- TLSH T155F6D5C2BAD9D0B6C0AD9334C56A92536A39FC44CB2797D71660BE342F327D0697D30A
- MD5 SHA1 SHA512 SSDEEP TLSH