89aaae045ea2490bdcf5e7d75e18579a758be54ed36fa418846b8bbd3da552e4

Analysis

max time kernel
150s
max time network
156s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-07_12c50e76bacff7e12ad7acfe09384ac2_coinminer_dosia_ghostlocker_glassworm_luca-stealer_poet-rat_quasar-rat.exe
Size 24.2MB
Sample261107-vb1tvaet8l
SHA256 89aaae045ea2490bdcf5e7d75e18579a758be54ed36fa418846b8bbd3da552e4
MD5 12c50e76bacff7e12ad7acfe09384ac2
SHA1 0c61a82feb3e81a98a411fb7dba8b6cf5297f972
SHA512 73c321456241dd5ebf88fce103274a1c111289cce26281574a8d6ca1bb5fe267b3978b13c8e48b0cbe67a95bf0784b26eab4361d8d9c89b697a34f2112072323
SSDEEP 196608:TZkdukAPLvijQ9/FODxyk1CLgmLkmp6TZ4vluZKW5fgYGxI:T2dNAPTD/FOZckmposOfg8
TLSH
T1C1477D47E82504E6C2B8C0F9895E564277B4BC081B25B7DB2B50F7287EB76D0BE7A350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-07_12c50e76bacff7e12ad7acfe09384ac2_coinminer_dosia_ghostlocker_glassworm_luca-stealer_poet-rat_quasar-rat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-07_12c50e76bacff7e12ad7acfe09384ac2_coinminer_dosia_ghostlocker_glassworm_luca-stealer_poet-rat_quasar-rat.exe

GoLang User-Agent 15 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	332	Go-http-client/1.1
HTTP User-Agent header	628	Go-http-client/1.1
HTTP User-Agent header	668	Go-http-client/1.1
HTTP User-Agent header	246	Go-http-client/1.1
HTTP User-Agent header	305	Go-http-client/1.1
HTTP User-Agent header	312	Go-http-client/1.1
HTTP User-Agent header	324	Go-http-client/1.1
HTTP User-Agent header	685	Go-http-client/1.1
HTTP User-Agent header	279	Go-http-client/1.1
HTTP User-Agent header	288	Go-http-client/1.1
HTTP User-Agent header	294	Go-http-client/1.1
HTTP User-Agent header	610	Go-http-client/1.1
HTTP User-Agent header	651	Go-http-client/1.1
HTTP User-Agent header	301	Go-http-client/1.1
HTTP User-Agent header	451	Go-http-client/1.1

C:\Users\Admin\AppData\Local\Temp\2026-11-07_12c50e76bacff7e12ad7acfe09384ac2_coinminer_dosia_ghostlocker_glassworm_luca-stealer_poet-rat_quasar-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-07_12c50e76bacff7e12ad7acfe09384ac2_coinminer_dosia_ghostlocker_glassworm_luca-stealer_poet-rat_quasar-rat.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
PID:4740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

config.json.tmp

Path C:\Users\Admin\AppData\Roaming\say\config.json.tmp
Size 13KB
SHA256 fc4cb4c0801df1c62ac98b33e0a8b3be4ccaecc6216d2163ade8a562d1f9b6fe
MD5 90783a9c334ba7aebb44c2cb96fb9956
SHA1 f99b656f00e4f7af2feaabb14cfb0b34251d7d8f
SHA512 a1a28902b7fe0ef6cfb1d55aa807b015573f04a285e7d467afae0aa6c839dec6b397be87e309b75f5df52e54e2b4c3f0804d3716dfe12dc3e15a9b49e3e81e32
SSDEEP 192:HTqeowOOCh93eVke+lE+5MdzU8XZszp23jAMA0AaAXjpn:zqeowbChZ/E+53p285RLXjpn
TLSH
T1F452CDFBD3405CE0508DA08952191AA3A505E9AB9CD5BD8AF320F40DEFDD48F707A76E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4740-5-0x00007FF7C57B0000-0x00007FF7C7056000-memory.dmp

Download

memory/4740-10-0x00007FF7C57B0000-0x00007FF7C7056000-memory.dmp

Download

memory/4740-11-0x00007FF7C57B0000-0x00007FF7C7056000-memory.dmp

Download

memory/4740-12-0x00007FF7C57B0000-0x00007FF7C7056000-memory.dmp

Download

memory/4740-13-0x00007FF7C57B0000-0x00007FF7C7056000-memory.dmp

Download

memory/4740-14-0x00007FF7C57B0000-0x00007FF7C7056000-memory.dmp

Download

memory/4740-15-0x00007FF7C57B0000-0x00007FF7C7056000-memory.dmp

Download

memory/4740-16-0x00007FF7C57B0000-0x00007FF7C7056000-memory.dmp

Download

memory/4740-17-0x00007FF7C57B0000-0x00007FF7C7056000-memory.dmp

Download

memory/4740-18-0x00007FF7C57B0000-0x00007FF7C7056000-memory.dmp

Download

memory/4740-19-0x00007FF7C57B0000-0x00007FF7C7056000-memory.dmp

Download

memory/4740-20-0x00007FF7C57B0000-0x00007FF7C7056000-memory.dmp

Download

memory/4740-21-0x00007FF7C57B0000-0x00007FF7C7056000-memory.dmp

Download

memory/4740-22-0x00007FF7C57B0000-0x00007FF7C7056000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads