2cf952f5c75e523c2d45010fdde70705ad773cecff4e6e05f3d261ca17be1c3c

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 11:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_9a35d6c268555c0d41e7fc74749b3bb2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 10.6MB
Sample261027-m6crhattcx
SHA256 2cf952f5c75e523c2d45010fdde70705ad773cecff4e6e05f3d261ca17be1c3c
MD5 9a35d6c268555c0d41e7fc74749b3bb2
SHA1 106f32fe2b8385d12658e878d6fbd5d117dd846e
SHA512 9aeaf67c2317caa49b2c4cdeeec11f8a882dd205c3095c0f68fa1b5630a4fe68e027953d43d5eb62963cf57785aa59b1254bcd6c7d73d7ee82d9cc6b61ceb149
SSDEEP 98304:oe5DoKqPC6Zjc+EXL1PPWcOmbnq2uDNcE:v90PuVlnWr
TLSH
T1C9B64A23ECA554E9C4ADC1708A669663BB717C491B3123D76FA0F6242F33BD0AD7A314
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 4 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4116	icacls.exe
5136	icacls.exe
3184	icacls.exe
1732	icacls.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3088 wrote to memory of 4116	3088	2026-10-26_9a35d6c268555c0d41e7fc74749b3bb2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	90
PID 3088 wrote to memory of 5136	3088	2026-10-26_9a35d6c268555c0d41e7fc74749b3bb2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	91
PID 3088 wrote to memory of 3184	3088	2026-10-26_9a35d6c268555c0d41e7fc74749b3bb2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	92
PID 3088 wrote to memory of 1732	3088	2026-10-26_9a35d6c268555c0d41e7fc74749b3bb2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-10-26_9a35d6c268555c0d41e7fc74749b3bb2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_9a35d6c268555c0d41e7fc74749b3bb2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3088
- C:\Windows\system32\icacls.exe
  icacls C:\Users\Admin\AppData\Local\Temp\TestAPIQueryAppearsOnlyWhenOpenedToTheAI1588724713\001\credentials.yaml /inheritance:r /grant:r *S-1-5-18:F /grant:r *S-1-5-32-544:F /grant:r *S-1-5-21-461973139-3212354679-1508698038-1000:F
  2⤵
  - Modifies file permissions
  PID:4116
- C:\Windows\system32\icacls.exe
  icacls C:\Users\Admin\AppData\Local\Temp\TestAPIQueryMapsDeviceTrimsRedactsAndLabels3458618122\001\credentials.yaml /inheritance:r /grant:r *S-1-5-18:F /grant:r *S-1-5-32-544:F /grant:r *S-1-5-21-461973139-3212354679-1508698038-1000:F
  2⤵
  - Modifies file permissions
  PID:5136
- C:\Windows\system32\icacls.exe
  icacls C:\Users\Admin\AppData\Local\Temp\TestListRecipesShowsAPIIntentsForControllerDevices477092473\001\credentials.yaml /inheritance:r /grant:r *S-1-5-18:F /grant:r *S-1-5-32-544:F /grant:r *S-1-5-21-461973139-3212354679-1508698038-1000:F
  2⤵
  - Modifies file permissions
  PID:3184
- C:\Windows\system32\icacls.exe
  icacls C:\Users\Admin\AppData\Local\Temp\TestAPIQueryIsNotAvailableToAutomaticInvestigation1805683114\001\credentials.yaml /inheritance:r /grant:r *S-1-5-18:F /grant:r *S-1-5-32-544:F /grant:r *S-1-5-21-461973139-3212354679-1508698038-1000:F
  2⤵
  - Modifies file permissions
  PID:1732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

apis.yaml

Path C:\Users\Admin\AppData\Local\Temp\TestAPIQueryAppearsOnlyWhenOpenedToTheAI1588724713\001\apis.yaml
Size 154B
SHA256 9f40cc809045f4ee95c2c9c30e5a663aee8a89ac1b69a217d611b3306489d328
MD5 76ed5e25c06168fa62e8fb5dfbf9185a
SHA1 75c91d828db660f3fef7bb47061cffea3df60c31
SHA512 44d30f42bab89384c071ca1d27aa3c687c88f87cd84be9e6dc71bc8c0d6d63c5722d7e9b5a9801a2f4a6bf431a1b4c76ced08603c9d1553f94b9334965af1b66
TLSH
T116C02B21CA6831B1DB30C01542A2540CC03FEC0F0D0A7D3375EC01100F0B9200055301
MD5 SHA1 SHA512 TLSH

Submit Download

credentials.yaml

Path C:\Users\Admin\AppData\Local\Temp\TestAPIQueryAppearsOnlyWhenOpenedToTheAI1588724713\001\credentials.yaml
Size 83B
SHA256 b65f853bc6532d3903a657b71432ad400098439e48ff6d8380087ebe7f31d0df
MD5 583e311ac5aa3d35d8f1e5ab7c8dc45b
SHA1 02dee10c7cc9d43f5d6d1dac7db71b79d0a1a82f
SHA512 a0620570ca6a5b3ce0836de2adffd0985784e353fce5ed50231b11cdfc236f1e7c35cdcb0582a214bfd606142318d44a44bc0c88b1ddab6bce7e2cb1aa796a81
TLSH
T1B8A0110A2038A802C28800033222E20A0000FC2280000A2A333C8A282F82BAAC00202A
MD5 SHA1 SHA512 TLSH

Submit Download

apis.yaml

Path C:\Users\Admin\AppData\Local\Temp\TestAPIQueryMapsDeviceTrimsRedactsAndLabels3458618122\001\apis.yaml
Size 176B
SHA256 b4b75836b8bc6f52a74bcf525149941da85f82ac9f35813d3550b39418c45bb1
MD5 9f0bafd0f1f174b72872f9c0edf8739e
SHA1 c2c6a9b771d3357481e792ba2a62f7dff1fb407f
SHA512 856f6b09e56d50d70267467dffe04719c3c2efe8bd92c08ac172332c171a53f8dc0c494487dc13a787d2dc05dfb0192f937df9ae650ded1f859e5ad0910054e1
TLSH
T183C08C22DA6831B2CB70C01902A2610C802EEC0B090A787276ED01100F0AA290116205
MD5 SHA1 SHA512 TLSH

Submit Download

apis.yaml

Path C:\Users\Admin\AppData\Local\Temp\TestListRecipesShowsAPIIntentsForControllerDevices477092473\001\apis.yaml
Size 176B
SHA256 83a2a07fa51db8f0960601c6dcfec8392c10697723906381f121dfb31b3a7d56
MD5 44f5f1cb1386938d2b681cad9685d77e
SHA1 2520d681e47f457a6da04d7cd448b8a34e06a70f
SHA512 3ac97dc7cf2e3015c48f3b9fc68270bf676511601615369c23936be987f59aa4fbf8faa82a720e9c1829ec733fa167e8eae68bc3b17751de769580327e539085
TLSH
T1A7C08C22EA6831B2CB70C01A02A2610DC06EEC0B090A783376ED01100F0AA2A041A209
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads