Analysis

  • max time kernel
    150s
  • max time network
    143s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/10/2026, 09:27

General

  • Target
    2026-10-28_1999b101720bebf69414eb48729edc6d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch_zxxz.exe
  • Size 19.6MB
  • Sample261030-le85ysa151
  • SHA256 a45d0d4af0d62fde8d30466626f9e37c4354d6c658bfe84a003b6f770b20ba56
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10

Malware Config

Signatures

  • Drops desktop.ini file(s) 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-28_1999b101720bebf69414eb48729edc6d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch_zxxz.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-28_1999b101720bebf69414eb48729edc6d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch_zxxz.exe"
    1⤵
    • Drops desktop.ini file(s)
    PID:4184

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        1123067750003631.xlsx

        • Path C:\Users\Admin\AppData\Local\Temp\TestBackupProblematicExcelFilesCopiesWithoutRemoval279707801\001\_excel_source_files\1123067750003631.xlsx
        • Size 5B
        • SHA256 78af7bdb5626eb0a046772b3edda705ca9e60ba7af0960eea89f7fa201d685a8
        • MD5 SHA1 SHA512

        canvas.fakehuge

        • Path C:\Users\Admin\AppData\Local\Temp\TestCheckImageDimensionsTable3236507976\001\canvas.fakehuge
        • Size 16B
        • SHA256 5d8d999bec1093000aa135493350e50f3d0c1d61103e5758e00a528b69edc9ea
        • MD5 SHA1 SHA512

        canvas.png

        • Path C:\Users\Admin\AppData\Local\Temp\TestCheckImageDimensionsTable3236507976\001\canvas.png
        • Size 45B
        • SHA256 a594f3331c56aa4349429940d852ffaa1f5615ec2873be4fa445439ecaa016b6
        • MD5 SHA1 SHA512

        1123067750003631_1.jpg

        • Path C:\Users\Admin\AppData\Local\Temp\TestCreateBackupForUnprocessedFilesFlatLayout1420327188\001\_unprocessed_files\1123067750003631_1.jpg
        • Size 3B
        • SHA256 d7439bee24773bcbfa2d0a97947ee36227b10d1022b1a55847e928965bb6bfde
        • MD5 SHA1 SHA512

        1123067750003631_2.jpg

        • Path C:\Users\Admin\AppData\Local\Temp\TestCreateBackupForUnprocessedFilesNestedLayout4079811562\001\shop7\1123067750003631_2.jpg
        • Size 6B
        • SHA256 233562de1a0288b139c4fa40b7d189f806e906eeb048517aeb67f34ac0e2faf1
        • MD5 SHA1 SHA512

        1123067750003631.txt

        • Path C:\Users\Admin\AppData\Local\Temp\TestCreateBackupInFolderRefreshesDirMtimeOnRewrite3629589730\001\_failed_orders\1123067750003631\1123067750003631.txt
        • Size 26B
        • SHA256 79278fe5a86c8122373350a0811a56537f1fe4b74f266cf254f7dec3f23e6bff
        • MD5 SHA1 SHA512

        f00003.txt

        • Path C:\Users\Admin\AppData\Local\Temp\TestExtractArchiveEntryCountCap1521929308\001\out\f00003.txt
        • Size 1B
        • SHA256 2d711642b726b04401627ca9fbac32f5c8530fb1903cc4db02258717921a4881
        • MD5 SHA1 SHA512

        b.txt

        • Path C:\Users\Admin\AppData\Local\Temp\TestMoveFileOverwritesExistingDestination1317897627\001\b.txt
        • Size 3B
        • SHA256 11507a0e2f5e69d5dfa40a62a1bd7b6ee57e6bcd85c67c9b8431b36fff21c437
        • MD5 SHA1 SHA512

        b.txt

        • Path C:\Users\Admin\AppData\Local\Temp\TestMoveFileRenamePath681710946\001\out\b.txt
        • Size 7B
        • SHA256 239f59ed55e737c77147cf55ad0c1b030b6d7ee748a7426952f9b852d5a935e5
        • MD5 SHA1 SHA512

        1123067750003631.jpg

        • Path C:\Users\Admin\AppData\Local\Temp\TestProcessDeliveredEndToEnd3303124127\001\src\1123067750003631.jpg
        • Size 110B
        • SHA256 9c17b30b4f7026f55ff616895b3c58e66c40fb8ea1d759126ec4ba310b71b11d
        • MD5 SHA1 SHA512 TLSH

        1123067750003631.txt

        • Path C:\Users\Admin\AppData\Local\Temp\TestProcessDeliveredEndToEnd3303124127\001\src\1123067750003631.txt
        • Size 12B
        • SHA256 40c30d9bbe9c8509c2597f8e5f64be783981bedfabf1c52f12f8b12a5b4d3657
        • MD5 SHA1 SHA512

        batch.zip

        • Path C:\Users\Admin\AppData\Local\Temp\TestProcessExtractsArchiveForTheNextTick1150376318\001\src\batch.zip
        • Size 170B
        • SHA256 45f4c8d57b9edc77dd5b15b321076100bdcf052ffdc662d32d1a85ea5dba1e19
        • MD5 SHA1 SHA512 TLSH

        1123067750003631.xlsx

        • Path C:\Users\Admin\AppData\Local\Temp\TestProcessFreshPayloadWaitsForStability1421768269\001\src\1123067750003631.xlsx
        • Size 5KB
        • SHA256 813a1f889712b64a74b5feb8c22b89278919a037e02c9a531f111155bff3eb6c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        batch.xlsx

        • Path C:\Users\Admin\AppData\Local\Temp\TestProcessLeftoverExcelStaysRetriableAfterFailedDelivery1459529695\001\src\batch.xlsx
        • Size 5KB
        • SHA256 eda912feace374b9aae14cffef155c6b3e0925321d817bdb76f1e19dc7942dbf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        1123067750003631.txt

        • Path C:\Users\Admin\AppData\Local\Temp\TestProcessReverseOverlapAlsoSkipped1058807115\001\1123067750003631.txt
        • Size 5B
        • SHA256 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824
        • MD5 SHA1 SHA512

        msg.txt

        • Path C:\Users\Admin\AppData\Local\Temp\TestPruneQuarantineFoldersNestedEntriesPrunedAsWhole1967009912\001\_failed_orders\order_b\nested\msg.txt
        • Size 1B
        • SHA256 62c66a7a5dd70c3146618063c344e531e6d4b59e379808443ce962b3abd63c5a
        • MD5 SHA1 SHA512

        tmp_1.jpg

        • Path C:\Users\Admin\AppData\Local\Temp\TestSaveImageDecodeFailureKeepsSourceRoot3152781543\001\dst\Shop\1123067750003631\tmp_1.jpg
        • Size 4B
        • SHA256 ef875a1705a5fdac206be996f4dc1f726ea6b68861eb741c37def7277f179e37
        • MD5 SHA1 SHA512

        tmp_1.jpg

        • Path C:\Users\Admin\AppData\Local\Temp\TestSaveImageDecodeFailureMovesRawFile2498495444\001\dst\Shop\1123067750003631\tmp_1.jpg
        • Size 19B
        • SHA256 d5e922eabc9aaeaeabe5cd879cdb67856e701774a0503e630d10d732e1ccbe6a
        • MD5 SHA1 SHA512

        1.jpg

        • Path C:\Users\Admin\AppData\Local\Temp\TestSaveImageDeliversAndRenamesPath1228644000\001\dst\ООО Ромашка\1123067750003631\1.jpg
        • Size 878B
        • SHA256 008f7e60d337c526bf53b815a0bcb779d47165b53a1cca5b560b5ba48e48e282
        • MD5 SHA1 SHA512 TLSH

        1.jpg

        • Path C:\Users\Admin\AppData\Local\Temp\TestSaveImageFinalizeFailureReturnsMovedSource2284603562\001\dst\ООО Ромашка\1123067750003631\1.jpg
        • Size 8B
        • SHA256 20323a24be105b1b519962994b8e4e6a7f8e3cd0d005b8ee10c9aeb66da5d40a
        • MD5 SHA1 SHA512

        1123067750003631_1.png

        • Path C:\Users\Admin\AppData\Local\Temp\TestSaveImageFirstIndexClearsTargetFolder522959928\001\src\1123067750003631_1.png
        • Size 136B
        • SHA256 4e1bc67762fdab4877b43f78366be54fb97b21c8d5295e3165c821ef9db8e21c
        • MD5 SHA1 SHA512 TLSH

        1123067750003631_2.png

        • Path C:\Users\Admin\AppData\Local\Temp\TestSaveImageIndexesSecondImage1592227689\001\src\1123067750003631_2.png
        • Size 138B
        • SHA256 7415c19a73676dae2fb4ec6c427d6f718963e20af2bd703bc9127682c353ce9a
        • MD5 SHA1 SHA512 TLSH

        1.jpg

        • Path C:\Users\Admin\AppData\Local\Temp\TestSaveImageResizesOversizeSides3539198102\001\dst\Shop\1123067750003631\1.jpg
        • Size 136KB
        • SHA256 5e04ccf24176feb96b8fd6e251f386e389c87b59ae352fc171ea0fad53e7c089
        • MD5 SHA1 SHA512 SSDEEP TLSH

        1123067750003631_1.png

        • Path C:\Users\Admin\AppData\Local\Temp\TestSaveImageRetriesWhenTargetFolderUncreatable1541836939\001\src\1123067750003631_1.png
        • Size 106B
        • SHA256 002a8ea41fc37aa6ad3f30873c422420aa446573944b709084c46b0467264433
        • MD5 SHA1 SHA512 TLSH

        c.txt

        • Path C:\Users\Admin\AppData\Local\Temp\TestScanFolder1108669945\001\sub\c.txt
        • Size 1B
        • SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
        • MD5 SHA1 SHA512

        pack.zip

        • Path C:\Users\Admin\AppData\Local\Temp\TestStepExtractArchivesExtractsStableArchive1431433546\001\pack.zip
        • Size 129B
        • SHA256 9fd5987800ea07c440ffd6eec2fccc544a12dbc8198e61cf9ef83955ae47f03e
        • MD5 SHA1 SHA512 TLSH

        broken.zip

        • Path C:\Users\Admin\AppData\Local\Temp\TestStepExtractArchivesQuarantinesBrokenArchive422463430\001\broken.zip
        • Size 13B
        • SHA256 69764ddcf44525dd275cf42a00a223699ef6d08535365b6793a439d5b3998023
        • MD5 SHA1 SHA512

        mystery.jpg

        • Path C:\Users\Admin\AppData\Local\Temp\TestStepSaveFeedbacksParksUnprocessedWithoutValidOrders2354193540\001\_unprocessed_files\mystery.jpg
        • Size 1B
        • SHA256 8a8de823d5ed3e12746a62ef169bcf372be0ca44f0a1236abc35df05d96928e1
        • MD5 SHA1 SHA512

        moved.txt

        • Path C:\pf2-move-2515337098\moved.txt
        • Size 20B
        • SHA256 feea15f3692af4b080c72f07316f07c2e9946d59c450402a5165600bdcff8aa9
        • MD5 SHA1 SHA512