Analysis
- max time kernel
149s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
29/10/2026, 17:23
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-10-29_0ef787e1813e1ab82ae22c5c65a46b6d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Resource
win10v2004-20260911-en
2 signatures
150 seconds
General
- Target 2026-10-29_0ef787e1813e1ab82ae22c5c65a46b6d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
- Size 18.0MB
- Sample261029-vx83caew8m
- SHA256 21d89d4859e1f51fdb21b7e8ca8fad4768adb804829795b5df23c68c65e3ef62
- MD5 0ef787e1813e1ab82ae22c5c65a46b6d
- SHA1 487a9ddaf9e9878a3327ccc3cb752670378d2a3b
- SHA512 a3d7bfeb2e8495c231c4b6977874a253e6ee0cae41fe089a01a567846108a32f21224b269b378295b68c35de11676a460b827656aa24f8ac5714fbe337662c2d
- SSDEEP 98304:yIcyaPZYm7i1kYvBeNb8o23mu7sT7qIhp9PSx12D+7fi9JdER:+7xPifvCB23m2sh/3Ci9JOR
- TLSH T1B9173907EC6514E9C0AED570C9629117BB71BC89473063DB5F60B628AF7ABE06DBE304
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4088 2026-10-29_0ef787e1813e1ab82ae22c5c65a46b6d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 4088 2026-10-29_0ef787e1813e1ab82ae22c5c65a46b6d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 4088 2026-10-29_0ef787e1813e1ab82ae22c5c65a46b6d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 4088 2026-10-29_0ef787e1813e1ab82ae22c5c65a46b6d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4088 2026-10-29_0ef787e1813e1ab82ae22c5c65a46b6d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-29_0ef787e1813e1ab82ae22c5c65a46b6d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-29_0ef787e1813e1ab82ae22c5c65a46b6d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4088