Analysis
- max time kernel
149s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/11/2026, 16:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-01_85fc99860ac0d6ccdf2832558e07b7eb_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Resource
win10v2004-20260911-en
2 signatures
150 seconds
General
- Target 2026-11-01_85fc99860ac0d6ccdf2832558e07b7eb_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
- Size 31.8MB
- Sample261102-tgqqdsfe95
- SHA256 ca811672573c930c6ba0dd0fd9ac3e010b74b4e951595485fc04d06e7c608687
- MD5 85fc99860ac0d6ccdf2832558e07b7eb
- SHA1 16e560936b6085185097d8c3209df92e09306c82
- SHA512 52c011020916cc600e18dcbadddc4827509d4b40eef24f8bc8f48bf3255b13ec40b9541ced8d744d7117e974d9c6d54a171675ac80d6bc575a8b1f9258dbeee3
- SSDEEP 393216:vJDP41SAO/US/m/utFCDfFTCH7boCQh6TNbw:JP4o/fO/oaf8QSNk
- TLSH T1CD777C03F4A10DE9E5EDD234C5A791267B313C55473123DB2BA4AA20BFBB7D45ABA304
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 2976 2026-11-01_85fc99860ac0d6ccdf2832558e07b7eb_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 2976 2026-11-01_85fc99860ac0d6ccdf2832558e07b7eb_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 2976 2026-11-01_85fc99860ac0d6ccdf2832558e07b7eb_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 2976 2026-11-01_85fc99860ac0d6ccdf2832558e07b7eb_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 2976 2026-11-01_85fc99860ac0d6ccdf2832558e07b7eb_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe - Suspicious use of AdjustPrivilegeToken 21 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2976 2026-11-01_85fc99860ac0d6ccdf2832558e07b7eb_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe Token: SeSecurityPrivilege 2976 2026-11-01_85fc99860ac0d6ccdf2832558e07b7eb_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe Token: SeTakeOwnershipPrivilege 2976 2026-11-01_85fc99860ac0d6ccdf2832558e07b7eb_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe Token: SeLoadDriverPrivilege 2976 2026-11-01_85fc99860ac0d6ccdf2832558e07b7eb_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe Token: SeSystemProfilePrivilege 2976 2026-11-01_85fc99860ac0d6ccdf2832558e07b7eb_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe Token: SeSystemtimePrivilege 2976 2026-11-01_85fc99860ac0d6ccdf2832558e07b7eb_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe Token: SeProfSingleProcessPrivilege 2976 2026-11-01_85fc99860ac0d6ccdf2832558e07b7eb_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe Token: SeIncBasePriorityPrivilege 2976 2026-11-01_85fc99860ac0d6ccdf2832558e07b7eb_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe Token: SeCreatePagefilePrivilege 2976 2026-11-01_85fc99860ac0d6ccdf2832558e07b7eb_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe Token: SeBackupPrivilege 2976 2026-11-01_85fc99860ac0d6ccdf2832558e07b7eb_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe Token: SeRestorePrivilege 2976 2026-11-01_85fc99860ac0d6ccdf2832558e07b7eb_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe Token: SeShutdownPrivilege 2976 2026-11-01_85fc99860ac0d6ccdf2832558e07b7eb_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe Token: SeDebugPrivilege 2976 2026-11-01_85fc99860ac0d6ccdf2832558e07b7eb_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe Token: SeSystemEnvironmentPrivilege 2976 2026-11-01_85fc99860ac0d6ccdf2832558e07b7eb_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe Token: SeRemoteShutdownPrivilege 2976 2026-11-01_85fc99860ac0d6ccdf2832558e07b7eb_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe Token: SeUndockPrivilege 2976 2026-11-01_85fc99860ac0d6ccdf2832558e07b7eb_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe Token: SeManageVolumePrivilege 2976 2026-11-01_85fc99860ac0d6ccdf2832558e07b7eb_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe Token: 33 2976 2026-11-01_85fc99860ac0d6ccdf2832558e07b7eb_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe Token: 34 2976 2026-11-01_85fc99860ac0d6ccdf2832558e07b7eb_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe Token: 35 2976 2026-11-01_85fc99860ac0d6ccdf2832558e07b7eb_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe Token: 36 2976 2026-11-01_85fc99860ac0d6ccdf2832558e07b7eb_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-01_85fc99860ac0d6ccdf2832558e07b7eb_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-01_85fc99860ac0d6ccdf2832558e07b7eb_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2976