Overview

overview

3

Static

static

3

2026-10-26...ch.exe

windows10-2004-x64

1

Analysis

  • max time kernel
    149s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    27/10/2026, 10:56

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-26_9b6ed8f27193fd9e6cbc4e5b6a1221c4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  • Size 27.8MB
  • Sample261027-m17ppatta1
  • SHA256 a7610f78cda03121c916ce697a6af940a37b94bc3020db929ea6a9af5b5f0a85
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-26_9b6ed8f27193fd9e6cbc4e5b6a1221c4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-26_9b6ed8f27193fd9e6cbc4e5b6a1221c4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
    1⤵
      PID:2692

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          recovery.age
          • Path C:\Users\Admin\AppData\Local\Temp\TestCallerCLIStagesOriginalKeyAndReconcilesWithoutActivation2843321404\002\recovery.age
          • Size 302B
          • SHA256 4a24b31424ec9c78d6b264e1d15cb93461398aee6ea187e3216b3f95dd9cff26
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          source.age
          • Path C:\Users\Admin\AppData\Local\Temp\TestCallerCLIStagesOriginalKeyAndReconcilesWithoutActivation2843321404\002\source.age
          • Size 1KB
          • SHA256 1730f985f56a7e378e1f147852d36fef9bbc96dc99f02ef5e7c49ce15fb7d531
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          time.json
          • Path C:\Users\Admin\AppData\Local\Temp\TestCallerCLIStagesOriginalKeyAndReconcilesWithoutActivation2843321404\002\time.json
          • Size 1KB
          • SHA256 d6cb27990079bf144da78b1a68234b5ea342901914f44f21e10edc709c37f5a5
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          recovery.age
          • Path C:\Users\Admin\AppData\Local\Temp\TestHistoryCLIProjectionVerificationAndRepeatReceipt1959106406\002\recovery.age
          • Size 302B
          • SHA256 1f7f816b2823239b523de113269e0a6f35fcefcd07341c63649817ac1bdd47d6
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          source.age
          • Path C:\Users\Admin\AppData\Local\Temp\TestHistoryCLIProjectionVerificationAndRepeatReceipt1959106406\002\source.age
          • Size 1KB
          • SHA256 a77a152fa1c780160a21b25cee508feab80caded1e12fce4b9683fd89800c710
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          time.json
          • Path C:\Users\Admin\AppData\Local\Temp\TestHistoryCLIProjectionVerificationAndRepeatReceipt1959106406\002\time.json
          • Size 1KB
          • SHA256 f97995aaac2f7a9be90be98f7c8f2adb4d6845a6d2c8cb4dfb3af903f28f95fa
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          recovery.age
          • Path C:\Users\Admin\AppData\Local\Temp\TestIncrementalCLIAuthenticatesBothSourcesAndNeverWrites2940973948\002\recovery.age
          • Size 302B
          • SHA256 be106e6ac59821aa0e3c7938ed5bf8228fbe391633ae7a5cd476774abcda26f5
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          source.age
          • Path C:\Users\Admin\AppData\Local\Temp\TestIncrementalCLIAuthenticatesBothSourcesAndNeverWrites2940973948\002\source.age
          • Size 1KB
          • SHA256 7a03aacf029df1ee71b9c31c9c21e59f31f38bb746fee9bb5703b9cbfa0a19df
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          time.json
          • Path C:\Users\Admin\AppData\Local\Temp\TestIncrementalCLIAuthenticatesBothSourcesAndNeverWrites2940973948\002\time.json
          • Size 1KB
          • SHA256 ceedc56f4174c01d6b4cafc7a6cc258f53db3ca59abb862e46fb02b35fa3c1d4
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          recovery.age
          • Path C:\Users\Admin\AppData\Local\Temp\TestIncrementalCallerCLIReusesSourceAuthenticationAndReadOnlyGua1462742134\002\recovery.age
          • Size 302B
          • SHA256 b736fa8273dda795a429fcecf6fe2c95462a976090762ad4ffb875b000f8eee0
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          source.age
          • Path C:\Users\Admin\AppData\Local\Temp\TestIncrementalCallerCLIReusesSourceAuthenticationAndReadOnlyGua1462742134\002\source.age
          • Size 1KB
          • SHA256 5305b7d5961145615c8a74e8273648237ef9a36065357e4a04dcbadd59cd660e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          time.json
          • Path C:\Users\Admin\AppData\Local\Temp\TestIncrementalCallerCLIReusesSourceAuthenticationAndReadOnlyGua1462742134\002\time.json
          • Size 1KB
          • SHA256 4100320bbc9e2b2bc75ec6373e16b5fa3d429e4d60c863d06a7791eda11a9805
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          recovery.age
          • Path C:\Users\Admin\AppData\Local\Temp\TestIncrementalConfigurationCLIReusesSourceAuthenticationAndRead2190717128\002\recovery.age
          • Size 302B
          • SHA256 03bd5fa626b23b6ef9f81163c59b13fc25cf4671decd4e0aabe226b78f43e8d8
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          source.age
          • Path C:\Users\Admin\AppData\Local\Temp\TestIncrementalConfigurationCLIReusesSourceAuthenticationAndRead2190717128\002\source.age
          • Size 1KB
          • SHA256 2dd4ec1530099a83aa7d6c967fc7afcc19796c13cffafa9150ca4389db21d55b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          time.json
          • Path C:\Users\Admin\AppData\Local\Temp\TestIncrementalConfigurationCLIReusesSourceAuthenticationAndRead2190717128\002\time.json
          • Size 1KB
          • SHA256 1be144f9bb7448e3888297da89dee7aa09bb6e6c63377ea61bf9c844daa9c0f1
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          recovery.age
          • Path C:\Users\Admin\AppData\Local\Temp\TestIncrementalCredentialCLIReusesSourceAuthenticationAndReadOnl52137396\002\recovery.age
          • Size 302B
          • SHA256 f1d38137cddce381686d4ced9c3364ca5fb6c5a8e95043843e77a8dfc1cd1889
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          source.age
          • Path C:\Users\Admin\AppData\Local\Temp\TestIncrementalCredentialCLIReusesSourceAuthenticationAndReadOnl52137396\002\source.age
          • Size 1KB
          • SHA256 bb10a952b45699be5f531464ca4bd48712d3d2d2de9e31704fbeb8758ec516c3
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          time.json
          • Path C:\Users\Admin\AppData\Local\Temp\TestIncrementalCredentialCLIReusesSourceAuthenticationAndReadOnl52137396\002\time.json
          • Size 1KB
          • SHA256 c24e542a658f6b4861f6951b6e065300cca0ebb95d44826fafeba79a13609b1c
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          recovery.age
          • Path C:\Users\Admin\AppData\Local\Temp\TestIncrementalMergeConstraintCLIReusesAuthenticationAndReadOnly3317920287\002\recovery.age
          • Size 302B
          • SHA256 4dd1f5f97f0f8498b1675d797e8aa224ea22007c2a3e0284a1ed3cd0925504b4
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          source.age
          • Path C:\Users\Admin\AppData\Local\Temp\TestIncrementalMergeConstraintCLIReusesAuthenticationAndReadOnly3317920287\002\source.age
          • Size 1KB
          • SHA256 7b4cfce72b03885b5e1973597b9c0f0890f7e3e0c3ecf72df4415e77dd212210
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          time.json
          • Path C:\Users\Admin\AppData\Local\Temp\TestIncrementalMergeConstraintCLIReusesAuthenticationAndReadOnly3317920287\002\time.json
          • Size 1KB
          • SHA256 d4de3ab8ee8015fdf396a8a548ea6877cfc9378b9c898b19188a9908a348c75b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          identity.dpapi
          • Path C:\Users\Admin\AppData\Local\Temp\TestPreflightCLIPairsTimeEvidenceAndRejectsMalformedInputPrivate2647451078\001\identity.dpapi
          • Size 333B
          • SHA256 4a07060bda35ff82a6432402428c003d499e222c903c4c50e03d2c6b1a607d2f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          synthetic-source.age
          • Path C:\Users\Admin\AppData\Local\Temp\TestPreflightCLIPairsTimeEvidenceAndRejectsMalformedInputPrivate2647451078\001\synthetic-source.age
          • Size 1KB
          • SHA256 2f7404f6c17af2c7b358462dee552a87fe2aa1beb63c36faee7d562b425a10a3
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          identity.dpapi
          • Path C:\Users\Admin\AppData\Local\Temp\TestPreflightCLIRoutesAuthenticatedArchiveAndBlocksUnsupportedSc2582618786\001\identity.dpapi
          • Size 333B
          • SHA256 c47f0f036019bd35bbfa7ca2dc246561dd02532f7c85129ab24657b13c3b3110
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          synthetic-source.age
          • Path C:\Users\Admin\AppData\Local\Temp\TestPreflightCLIRoutesAuthenticatedArchiveAndBlocksUnsupportedSc2582618786\001\synthetic-source.age
          • Size 954B
          • SHA256 2377180e17b6b843e0f366a22d608b9bd906961df56d1e55f80e86271c2f4d1f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          recovery.age
          • Path C:\Users\Admin\AppData\Local\Temp\TestRetainedHistoryCLIIsSourceGuardedReadOnlyAndNeverTrafficRead1392560992\002\recovery.age
          • Size 302B
          • SHA256 9c2ed4e135c526221b3372f36e489acd1359882166afdb1b97a66374eb9bfa32
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          source.age
          • Path C:\Users\Admin\AppData\Local\Temp\TestRetainedHistoryCLIIsSourceGuardedReadOnlyAndNeverTrafficRead1392560992\002\source.age
          • Size 1KB
          • SHA256 34f9643467d009fdfbf551d9d133d94eb81bd5d52dca42ec11de30c820da3288
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          time.json
          • Path C:\Users\Admin\AppData\Local\Temp\TestRetainedHistoryCLIIsSourceGuardedReadOnlyAndNeverTrafficRead1392560992\002\time.json
          • Size 1KB
          • SHA256 7e46f1131832a8332a3b45e99f54626bfeab6c03181217ab846cc319c51c35d5
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          recovery.age
          • Path C:\Users\Admin\AppData\Local\Temp\TestRuntimeCLIStagesLeaseAndAuthenticatesAllSourcesBeforeTarget2320320732\002\recovery.age
          • Size 302B
          • SHA256 c6bdf661d9cff571e4b4c20f52e77d2c421e895366af386d77e346a5386a0d1e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          source.age
          • Path C:\Users\Admin\AppData\Local\Temp\TestRuntimeCLIStagesLeaseAndAuthenticatesAllSourcesBeforeTarget2320320732\002\source.age
          • Size 1KB
          • SHA256 80aecb644f5586fe7780332b87359c4aaf25f2b156dff354ca28d7aadf44744d
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          time.json
          • Path C:\Users\Admin\AppData\Local\Temp\TestRuntimeCLIStagesLeaseAndAuthenticatesAllSourcesBeforeTarget2320320732\002\time.json
          • Size 1KB
          • SHA256 948cebcddbf754ab37463265f79f23700f0546492553a028825b5e760890f351
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          runtime.age
          • Path C:\Users\Admin\AppData\Local\Temp\TestRuntimeCLIStagesLeaseAndAuthenticatesAllSourcesBeforeTarget2320320732\003\runtime.age
          • Size 682B
          • SHA256 f8f110635634a4e7053227ef5a09a91a4a3bb8ed4689849764d02754e2732628
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          runtime.age
          • Path C:\Users\Admin\AppData\Local\Temp\TestRuntimeCLIStagesLeaseAndAuthenticatesAllSourcesBeforeTarget2320320732\004\runtime.age
          • Size 682B
          • SHA256 3af48746777864fbabe095a4601f4313193eba118f9f018536695af11da39247
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          recovery.age
          • Path C:\Users\Admin\AppData\Local\Temp\TestStageCLIAuthenticatesArchiveAndTimeBeforeOpeningTarget4069860469\002\recovery.age
          • Size 302B
          • SHA256 06c1366c03bd4d1a77c9ef26894e622ed1b6821b8a715f802bb7cf1a6044d212
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          source.age
          • Path C:\Users\Admin\AppData\Local\Temp\TestStageCLIAuthenticatesArchiveAndTimeBeforeOpeningTarget4069860469\002\source.age
          • Size 1KB
          • SHA256 220343287edaec5ac3dba073ce179f08d27c9a23204b41d5846d9413bacb599a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          time.json
          • Path C:\Users\Admin\AppData\Local\Temp\TestStageCLIAuthenticatesArchiveAndTimeBeforeOpeningTarget4069860469\002\time.json
          • Size 1KB
          • SHA256 36b4bb59f4f2e54260548c7d7cf725a2497c1db418df0047bbe3e76b1f004712
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          recovery.age
          • Path C:\Users\Admin\AppData\Local\Temp\TestStageCLIClosesFailedTargetAndKeepsErrorsPrivate1431375451\002\recovery.age
          • Size 302B
          • SHA256 d37a35a88883be22752847ef06c7af1750c4d7774c6729e1c711759b57f2624a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          source.age
          • Path C:\Users\Admin\AppData\Local\Temp\TestStageCLIClosesFailedTargetAndKeepsErrorsPrivate1431375451\002\source.age
          • Size 1KB
          • SHA256 33291cc41d856e9e052a53e80e30c97c20a0fb2e642a193619be403d8e3a5a09
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          recovery.age
          • Path C:\Users\Admin\AppData\Local\Temp\TestStageCLIProducesDisabledReceiptAndRejectsRepeat794020040\002\recovery.age
          • Size 302B
          • SHA256 31826faf0efc805e8b592bb14c473408cd8214369368333f1ff5370731cb8149
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          source.age
          • Path C:\Users\Admin\AppData\Local\Temp\TestStageCLIProducesDisabledReceiptAndRejectsRepeat794020040\002\source.age
          • Size 1KB
          • SHA256 65c440b867915cc78df7cd7ae778794808484e5d535279f3e4742d7c8f4c6fb7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          time.json
          • Path C:\Users\Admin\AppData\Local\Temp\TestStageCLIProducesDisabledReceiptAndRejectsRepeat794020040\002\time.json
          • Size 1KB
          • SHA256 264507d1108ea5f9e2ed85fa7c8253331a52fcbce9569815086fe6dfb672d63f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          recovery.age
          • Path C:\Users\Admin\AppData\Local\Temp\TestStageCLIReconcilesLostCommitOrOutputWithoutReplayingWritesc2432679478\002\recovery.age
          • Size 302B
          • SHA256 d14ace0428972352e0148f38943a31163340b7f8d7e8054175ab3718c4d98ab4
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          source.age
          • Path C:\Users\Admin\AppData\Local\Temp\TestStageCLIReconcilesLostCommitOrOutputWithoutReplayingWritesc2432679478\002\source.age
          • Size 1KB
          • SHA256 6dce8bf0ec825e3943f7967ab1185660ee1a38e7fd4451defba33de099f02f64
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          recovery.age
          • Path C:\Users\Admin\AppData\Local\Temp\TestStageCLIReconcilesLostCommitOrOutputWithoutReplayingWriteso1329515317\002\recovery.age
          • Size 302B
          • SHA256 9a4044c34b58b30b51ce24f9b59e3c977653060109a7e47f1afc8fca46dfd7c2
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          source.age
          • Path C:\Users\Admin\AppData\Local\Temp\TestStageCLIReconcilesLostCommitOrOutputWithoutReplayingWriteso1329515317\002\source.age
          • Size 1KB
          • SHA256 5ddaa8c14495dbe1fe029fa9b82a960c14d468699a8ad1c32988c42a9c229811
          • MD5 SHA1 SHA512 TLSH
          Submit Download