Analysis
- max time kernel
150s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
02/11/2026, 01:57
General
- Target 2026-11-01_fbce22ac9027feb73c2ccba30e1fae98_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
- Size 13.4MB
- Sample261102-cdc7fsdh65
- SHA256 d3891a8df5e73e83211a38bcde4d2afd06c1ad23c8c329cdb0f0b4f290e0414e
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Drops file in Program Files directory 2 IoCs
- Drops file in Windows directory 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Modifies registry class 11 IoCs
- Modifies registry key 1 TTPs 4 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-01_fbce22ac9027feb73c2ccba30e1fae98_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-01_fbce22ac9027feb73c2ccba30e1fae98_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"1⤵
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -NonInteractive -Command "$s = (New-Object -ComObject WScript.Shell).CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Archon.lnk'); $s.TargetPath = 'C:\Program Files\Archon\launcher.exe'; $s.WorkingDirectory = 'C:\Program Files\Archon'; $s.Description = 'Archon — your AI office'; $s.IconLocation = 'C:\Program Files\Archon\launcher.exe'; $s.Save()"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -NonInteractive -Command "$s = (New-Object -ComObject WScript.Shell).CreateShortcut('C:\Users\Public\Desktop\Archon.lnk'); $s.TargetPath = 'C:\Program Files\Archon\launcher.exe'; $s.WorkingDirectory = 'C:\Program Files\Archon'; $s.Description = 'Archon — your AI office'; $s.IconLocation = 'C:\Program Files\Archon\launcher.exe'; $s.Save()"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\reg.exereg.exe add HKLM\SOFTWARE\Classes\archon /ve /t REG_SZ /d "URL:Archon Protocol" /f2⤵
- Modifies registry class
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg.exe add HKLM\SOFTWARE\Classes\archon /v "URL Protocol" /t REG_SZ /d "" /f2⤵
- Modifies registry class
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg.exe add HKLM\SOFTWARE\Classes\archon\DefaultIcon /ve /t REG_SZ /d "C:\Program Files\Archon\launcher.exe,0" /f2⤵
- Modifies registry class
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg.exe add HKLM\SOFTWARE\Classes\archon\shell\open\command /ve /t REG_SZ /d "\"C:\Program Files\Archon\launcher.exe\" \"%1\"" /f2⤵
- Modifies registry class
- Modifies registry key
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /Delete /TN ArchonLauncher /F2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /Create /TN ArchonLauncher /XML C:\Windows\Temp\archon-task-666497925.xml /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\wsl.exewsl.exe --status2⤵
-
-
C:\Windows\system32\dism.exedism.exe /online /enable-feature /featurename:Microsoft-Windows-Subsystem-Linux /all /norestart2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Dism\dismhost.exeC:\Windows\System32\Dism\dismhost.exe {ECF5CA90-4552-496A-AD1D-38C7A8CAFDBC}3⤵
- Drops file in Windows directory
-
-
-
C:\Windows\system32\wsl.exewsl.exe -d Ubuntu-22.04 -u root -- bash /mnt/c/Windows/Temp/archon-diagnose-1793584668612597800.sh2⤵
-
-
C:\Program Files\Archon\launcher.exe"C:\Program Files\Archon\launcher.exe"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Archon\archon-setup.exe"C:\Program Files\Archon\archon-setup.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
archon-setup.exe
launcher.exe
launcher.log
setup.lock
setup.log
state.json
state.json
state.json
StartupProfileData-NonInteractive
__PSScriptPolicyTest_oq1n5nsg.h3c.ps1
dism.log
archon-task-666497925.xml
memory/5984-19-0x000001DED90E0000-0x000001DED9102000-memory.dmp
memory/5984-29-0x00007FF899460000-0x00007FF899E04000-memory.dmp
memory/5984-28-0x00007FF899460000-0x00007FF899E04000-memory.dmp
memory/5984-24-0x00007FF899460000-0x00007FF899E04000-memory.dmp
memory/5984-23-0x00007FF899460000-0x00007FF899E04000-memory.dmp
memory/5984-21-0x00007FF899460000-0x00007FF899E04000-memory.dmp
memory/5984-13-0x00007FF899460000-0x00007FF899E04000-memory.dmp
memory/5984-12-0x00007FF899460000-0x00007FF899E04000-memory.dmp
memory/5984-11-0x00007FF8995EF000-0x00007FF8995F0000-memory.dmp