Analysis
- max time kernel
150s - max time network
119s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
28/05/2026, 08:32
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-05-28_88833583ae843ea7e270639bb07b05f9_coinminer_glassworm_poet-rat_sliver_snatch.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-28_88833583ae843ea7e270639bb07b05f9_coinminer_glassworm_poet-rat_sliver_snatch.exe
Resource
win11-20260513-en
windows11-21h2-x64
5 signatures
150 seconds
General
- Target 2026-05-28_88833583ae843ea7e270639bb07b05f9_coinminer_glassworm_poet-rat_sliver_snatch.exe
- Size 20.3MB
- Sample260528-kfer3act6w
- SHA256 e91fe4a606d1f952e322c03197a1f9b87331c10ef8b7a8ebd64d1dc5f7dbd5a2
- MD5 88833583ae843ea7e270639bb07b05f9
- SHA1 0110b9dbe194827050c39b0fe2d66a3552a0627d
- SHA512 d4a64870658733648143069f91678ab222e6907fc007309ef335a35e69328037e2f3031b3ac7ab1a59f3ec8c75a334ab46aa9ea1457ff5db2e09c698acd5daa0
- SSDEEP 393216:DAkLRCR3R7R6RLRKRRR1RARdRYRORkRIRRR+RGRIRYRaR3:Ef
- TLSH T1C427CF31B7E849AAC2BFD379D06206261EF0B827622BEB4F5E8054FD1D53BD09915363
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables referencing virtualization MAC addresses 1 IoCs
resource yara_rule behavioral2/files/0x001a00000002b47f-4.dat INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ATfFDUlb = "c:\\Windows\\System32\\ATfFDUlb.exe" 2026-05-28_88833583ae843ea7e270639bb07b05f9_coinminer_glassworm_poet-rat_sliver_snatch.exe - Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-05-28_88833583ae843ea7e270639bb07b05f9_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\desktop.ini 2026-05-28_88833583ae843ea7e270639bb07b05f9_coinminer_glassworm_poet-rat_sliver_snatch.exe - Drops file in System32 directory 1 IoCs
description ioc Process File created \??\c:\Windows\System32\ATfFDUlb.exe 2026-05-28_88833583ae843ea7e270639bb07b05f9_coinminer_glassworm_poet-rat_sliver_snatch.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe.manifest.exe 2026-05-28_88833583ae843ea7e270639bb07b05f9_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RIPPLE\PREVIEW.GIF.exe 2026-05-28_88833583ae843ea7e270639bb07b05f9_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Mozilla Firefox\xul.dll 2026-05-28_88833583ae843ea7e270639bb07b05f9_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_x64__8wekyb3d8bbwe\Assets\GetHelpAppList.targetsize-80.png.exe 2026-05-28_88833583ae843ea7e270639bb07b05f9_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib-amd\dom\IVirtualElement.js 2026-05-28_88833583ae843ea7e270639bb07b05f9_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\PresentationFramework-SystemCore.dll.exe 2026-05-28_88833583ae843ea7e270639bb07b05f9_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\PowerPivotExcelClientAddIn.tlb.exe 2026-05-28_88833583ae843ea7e270639bb07b05f9_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 2026-05-28_88833583ae843ea7e270639bb07b05f9_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxBlockMap.xml.exe 2026-05-28_88833583ae843ea7e270639bb07b05f9_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\Assets\ClippingTool.targetsize-64.png.exe 2026-05-28_88833583ae843ea7e270639bb07b05f9_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.VisualBasic.dll.exe 2026-05-28_88833583ae843ea7e270639bb07b05f9_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-05-28_88833583ae843ea7e270639bb07b05f9_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\Shield.png 2026-05-28_88833583ae843ea7e270639bb07b05f9_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_1.0.38.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-64_altform-lightunplated_contrast-black.png.exe 2026-05-28_88833583ae843ea7e270639bb07b05f9_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\PresentationCore.resources.dll 2026-05-28_88833583ae843ea7e270639bb07b05f9_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-ppd.xrm-ms 2026-05-28_88833583ae843ea7e270639bb07b05f9_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\BKANT.TTF 2026-05-28_88833583ae843ea7e270639bb07b05f9_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Conversion.v3.5.dll 2026-05-28_88833583ae843ea7e270639bb07b05f9_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2020.503.58.0_x64__8wekyb3d8bbwe\Assets\contrast-black\CameraAppList.targetsize-36.png.exe 2026-05-28_88833583ae843ea7e270639bb07b05f9_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\HxOutlook.View.dll.exe 2026-05-28_88833583ae843ea7e270639bb07b05f9_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipTsf.dll.mui.exe 2026-05-28_88833583ae843ea7e270639bb07b05f9_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-pl.xrm-ms.exe 2026-05-28_88833583ae843ea7e270639bb07b05f9_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.SETLANG.16.1033.hxn.exe 2026-05-28_88833583ae843ea7e270639bb07b05f9_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Aero.dll 2026-05-28_88833583ae843ea7e270639bb07b05f9_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-64_contrast-black.png.exe 2026-05-28_88833583ae843ea7e270639bb07b05f9_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\Assets\folder.png 2026-05-28_88833583ae843ea7e270639bb07b05f9_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_1.0.22.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-80_contrast-black.png.exe 2026-05-28_88833583ae843ea7e270639bb07b05f9_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationClient.resources.dll.exe 2026-05-28_88833583ae843ea7e270639bb07b05f9_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt 2026-05-28_88833583ae843ea7e270639bb07b05f9_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Grayscale.xml 2026-05-28_88833583ae843ea7e270639bb07b05f9_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-private-l1-1-0.dll 2026-05-28_88833583ae843ea7e270639bb07b05f9_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2020.503.58.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\CameraSplashScreen.scale-125.png.exe 2026-05-28_88833583ae843ea7e270639bb07b05f9_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Images\contrast-black\PowerAutomateSquare71x71Logo.scale-400.png 2026-05-28_88833583ae843ea7e270639bb07b05f9_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\es\System.Windows.Controls.Ribbon.resources.dll.exe 2026-05-28_88833583ae843ea7e270639bb07b05f9_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ja\Microsoft.VisualBasic.Forms.resources.dll 2026-05-28_88833583ae843ea7e270639bb07b05f9_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\InkObj.dll.mui.exe 2026-05-28_88833583ae843ea7e270639bb07b05f9_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libhqdn3d_plugin.dll 2026-05-28_88833583ae843ea7e270639bb07b05f9_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Windows Media Player\ja-JP\wmpnscfg.exe.mui 2026-05-28_88833583ae843ea7e270639bb07b05f9_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_x64__8wekyb3d8bbwe\Windows.Devices.Printers.PrintersContract.winmd 2026-05-28_88833583ae843ea7e270639bb07b05f9_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailSmallTile.scale-125.png 2026-05-28_88833583ae843ea7e270639bb07b05f9_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-localization-l1-2-0.dll.exe 2026-05-28_88833583ae843ea7e270639bb07b05f9_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-ppd.xrm-ms.exe 2026-05-28_88833583ae843ea7e270639bb07b05f9_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\strings.resjson.exe 2026-05-28_88833583ae843ea7e270639bb07b05f9_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\LocalBridge.exe.exe 2026-05-28_88833583ae843ea7e270639bb07b05f9_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-40.png.exe 2026-05-28_88833583ae843ea7e270639bb07b05f9_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-05-28_88833583ae843ea7e270639bb07b05f9_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ScreenSketch_11.2104.2.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\SnipSketchStoreLogo.scale-125.png.exe 2026-05-28_88833583ae843ea7e270639bb07b05f9_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_4.0.2.0_x64__8wekyb3d8bbwe\Assets\Icons\StickyNotesAppList.targetsize-256_altform-unplated_contrast-white.png.exe 2026-05-28_88833583ae843ea7e270639bb07b05f9_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\Resources.pri.exe 2026-05-28_88833583ae843ea7e270639bb07b05f9_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\CLVWINTL.DLL 2026-05-28_88833583ae843ea7e270639bb07b05f9_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\liblive555_plugin.dll.exe 2026-05-28_88833583ae843ea7e270639bb07b05f9_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\plugins\visualization\libgoom_plugin.dll.exe 2026-05-28_88833583ae843ea7e270639bb07b05f9_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.ComponentModel.TypeConverter.dll 2026-05-28_88833583ae843ea7e270639bb07b05f9_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ppd.xrm-ms.exe 2026-05-28_88833583ae843ea7e270639bb07b05f9_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\vlc.mo 2026-05-28_88833583ae843ea7e270639bb07b05f9_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Windows Defender\fr-FR\MpAsDesc.dll.mui.exe 2026-05-28_88833583ae843ea7e270639bb07b05f9_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\Assets\SnipSketchAppList.targetsize-48.png 2026-05-28_88833583ae843ea7e270639bb07b05f9_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreAppList.targetsize-60_altform-lightunplated.png 2026-05-28_88833583ae843ea7e270639bb07b05f9_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_Mocking.help.txt.exe 2026-05-28_88833583ae843ea7e270639bb07b05f9_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\WindowsFormsIntegration.resources.dll 2026-05-28_88833583ae843ea7e270639bb07b05f9_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\7-Zip\Lang\kk.txt.exe 2026-05-28_88833583ae843ea7e270639bb07b05f9_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.Calendars.dll 2026-05-28_88833583ae843ea7e270639bb07b05f9_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\libGLESv2.dll.exe 2026-05-28_88833583ae843ea7e270639bb07b05f9_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.BingNews_1.0.6.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\NewsSplashScreen.scale-200_contrast-white.png 2026-05-28_88833583ae843ea7e270639bb07b05f9_coinminer_glassworm_poet-rat_sliver_snatch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-28_88833583ae843ea7e270639bb07b05f9_coinminer_glassworm_poet-rat_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-28_88833583ae843ea7e270639bb07b05f9_coinminer_glassworm_poet-rat_sliver_snatch.exe"1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
PID:5024
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7-zip.dll.exe
- Size 21.0MB
- SHA256 407fbc75c737c7423341a5409f6bfe44a242edd00f1165236a2a0c69556c58cb
- MD5 5cee1648d6b24c29dc3af8d4790dd13a
- SHA1 b05d796e497f5bb82cec576b0e9629da91bb2817
- SHA512 14fe1a0184ab2b9003ca08040b5ad73189050ea5da8688e3b466f6fbdbb0a4b53c1d5335044b0fb5bd8a8cc7a8b5424797dd457344ec5c83f97ceaf802e1e2dc
- SSDEEP 393216:DAkLRCR3R7R6RLRKRRR1RARdRYRORkRIRRR+RGRIRYRaRIRY:Ez
- TLSH T14C27CF21B7E849AAC2EFD379D06206261FF0B427622BEB8F5E8054FD1D53BD09915363
- MD5 SHA1 SHA512 SSDEEP TLSH