Overview

overview

3

Static

static

3

2026-11-13...xz.exe

windows10-2004-x64

1

2026-11-13...xz.exe

windows11-ltsc_2024-x64

1

Analysis

  • max time kernel
    149s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    13/11/2026, 22:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-13_d184b85fa9ba685f551750ea7dda5063_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch_zxxz.exe
  • Size 45.1MB
  • Sample261113-2bd4eahw2z
  • SHA256 f1b4da8f3a47e157618e8748c11de1219c84501391a0ad0f2f950e52c4de42ee
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-13_d184b85fa9ba685f551750ea7dda5063_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch_zxxz.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-13_d184b85fa9ba685f551750ea7dda5063_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch_zxxz.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:4356

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        ca.pem
        • Path C:\Users\Admin\AppData\Local\Temp\TestNATSCAPinningConcurrentInstall847271879\001\ca.pem
        • Size 591B
        • SHA256 635205db2c64ca3340e490ef46364190d55221c5542aa68d6621daf934c7986e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        .nats-ca-1170984849
        • Path C:\Users\Admin\AppData\Local\Temp\TestNATSCAPinningInstallAndConflict1116161024\001\.nats-ca-1170984849
        • Size 587B
        • SHA256 0e42be77a1ca13f5a9eb759b8192356d9794336c4bc9a1d11f89222ac0de8247
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ca.pem
        • Path C:\Users\Admin\AppData\Local\Temp\TestNATSCAPinningRechecksBeforeStartper-service2650066977\001\ca.pem
        • Size 587B
        • SHA256 728b37966b8d4b83f1052a9e15c50ebf903256f5652f5ff39ff3819648285f33
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ca.pem
        • Path C:\Users\Admin\AppData\Local\Temp\TestNATSCAPinningRechecksBeforeStartreplace2411732657\001\ca.pem
        • Size 587B
        • SHA256 1e0989f565e1ca4b682d4acd54d589d030bfdb5a128b76107b172086999df627
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ca.pem
        • Path C:\Users\Admin\AppData\Local\Temp\TestNATSCAPinningRejectsPerServiceOverrideconfigured145683175\001\ca.pem
        • Size 587B
        • SHA256 53db98216f555c3c5dd468bfea31cd7d550fc5c38dd362f5b5dcc52c4a56d3ba
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ca.pem
        • Path C:\Users\Admin\AppData\Local\Temp\TestNATSCAPinningTLSHandshaketrusted-per-service3731811020\001\ca.pem
        • Size 591B
        • SHA256 2563fd4603b709e03c1ca40cb6a59305d2eb4f0959bcf53443af7bbd84104277
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ca.pem
        • Path C:\Users\Admin\AppData\Local\Temp\TestNATSCAPinningTLSHandshaketrusted3711009013\001\ca.pem
        • Size 591B
        • SHA256 ce8b871da05a2789c9cfdf6adf5d472247bd286c8878823b1acb3e92eadec048
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ca.pem
        • Path C:\Users\Admin\AppData\Local\Temp\TestNATSCAPinningTLSHandshakeuntrusted3235878043\001\ca.pem
        • Size 591B
        • SHA256 175f9e9119b2be425b09efaae1b5ad493c7ebd3aa599de8363a879744167e825
        • MD5 SHA1 SHA512 TLSH
        Submit Download