65deea81c64a1a6128f70ef91e283bf8df6ac63534de448110a0d98026a83216

General

Target
2026-06-28_2a475fb44acc1389b53dcc0cefb66a22_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
Size 6.4MB
Sample260628-3pr3vsgx3w
SHA256 65deea81c64a1a6128f70ef91e283bf8df6ac63534de448110a0d98026a83216
MD5 2a475fb44acc1389b53dcc0cefb66a22
SHA1 4f81ba457c8089235529efde876a431bd8a3228e
SHA512 2a7ce0b55731fbd2f3e28f980ae0381fd3c4e3410a2c622417f977595b00910c826843150eaaffe144464c1478d03f98733da0883df5d4a84459ee1e36b9258a
SSDEEP 98304:wkGQg1LS4hPbU/llpwXHaT2YI3z5oNfMcI:HGP1LS4hPw/llpwXHaT2p3UfMcI
TLSH
T144664A12FCA205F6C2BEF5348256E322BA7138A543313BD75F9496671666FE07A3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1808	MsMpEng.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\Defender\MsMpEng.dll	2026-06-28_2a475fb44acc1389b53dcc0cefb66a22_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
File opened for modification	C:\Windows\Defender\Defender.dll	2026-06-28_2a475fb44acc1389b53dcc0cefb66a22_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
File created	C:\Windows\Defender\MsMpEng.exe	MsMpEng.exe
File opened for modification	C:\Windows\Defender\Defender.dll	MsMpEng.exe
File created	C:\Windows\Defender\MsMpEng.exe	2026-06-28_2a475fb44acc1389b53dcc0cefb66a22_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
File opened for modification	C:\Windows\Defender\MsMpEng.exe	2026-06-28_2a475fb44acc1389b53dcc0cefb66a22_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe

GoLang User-Agent 4 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	8	Go-http-client/1.1
HTTP User-Agent header	16	Go-http-client/1.1
HTTP User-Agent header	33	Go-http-client/1.1
HTTP User-Agent header	59	Go-http-client/1.1

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3956	sChTAsks.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 3004	2268	2026-06-28_2a475fb44acc1389b53dcc0cefb66a22_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe	91
PID 2268 wrote to memory of 3956	2268	2026-06-28_2a475fb44acc1389b53dcc0cefb66a22_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe	92
PID 1808 wrote to memory of 816	1808	MsMpEng.exe	100

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-06-28_2a475fb44acc1389b53dcc0cefb66a22_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-28_2a475fb44acc1389b53dcc0cefb66a22_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Windows\system32\sCHtAsks.exe
  sCHtAsks.exe /query /tn WindowsDefenderScan
  2⤵
  PID:3004
- C:\Windows\system32\sChTAsks.exe
  sChTAsks.exe /create /xml C:\Users\Admin\AppData\Local\Temp\krebsonsecurity.xml /tn WindowsDefenderScan
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3956

C:\Windows\Defender\MsMpEng.exe
C:\Windows\Defender\MsMpEng.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Windows\system32\sCHtAsks.exe
  sCHtAsks.exe /query /tn WindowsDefenderScan
  2⤵
  PID:816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

krebsonsecurity.xml

Path C:\Users\Admin\AppData\Local\Temp\krebsonsecurity.xml
Size 1KB
SHA256 038d08516deffd7769e5923d3d4c41c74843a387a7f9aee5353b1d1e3e07983e
MD5 b679f43e10b19e85edd9fd17f4c8f29b
SHA1 58470c1ba3d42232fc87500f737f25182c30a72d
SHA512 41b0c32aa58da1222b7154185b36d24aeaa5268b7137534e6cb5fc0112fb8499b96a1597cd35b158b80dd896c474cb18bf67d1df83535937194db11fc656a94b
TLSH
T1C331DF64E8F0F35BB252662893512A835F6A87B381558134F8CC4A7C6F8F685615353B
MD5 SHA1 SHA512 TLSH

Submit Download

Defender.dll

Path C:\Windows\Defender\Defender.dll
Size 33B
SHA256 04d2775213b3cf7daa046700c7a0db8e18422511e07c549f1326f8e56e17fc30
MD5 953b34ccfe1763d3433b9af2319c8da7
SHA1 ce376afa25e3e44637d505c99a070dd764fa1dc4
SHA512 d0cbf218d175e3788781843774d3c3cc140399d7c6150565bfc67ae4cdbff94bc829b3238d1e0aa4a175731a25821523fca69d4ac360109e45cd024bcc3a5749
MD5 SHA1 SHA512

Submit Download

MsMpEng.dll

Path C:\Windows\Defender\MsMpEng.dll
Size 3KB
SHA256 42c86fa93c1bccaa8409ce0adffb658e29192b89ce7204d510568e1ed4bba17d
MD5 8a3e453fbc6e11a73b96a3a7e9a0c55c
SHA1 652a5e638f3068742c8b5c64c6bd49d3cd886173
SHA512 680d722737a91165ac9b172b79f17eac5a70f9326332862c21510ba5da39e4d0dd03d0f05e24e46ab907454808a56d3bba27037ef5fe0a27529f05459b7d57fd
TLSH
T1E9716D2307E0585ADFA5E54303291ABE7168FB73AEA9C25045132C0C63888BD673EC76
MD5 SHA1 SHA512 TLSH

Submit Download

MsMpEng.exe

Path C:\Windows\Defender\MsMpEng.exe
Size 6.4MB
SHA256 65deea81c64a1a6128f70ef91e283bf8df6ac63534de448110a0d98026a83216
MD5 2a475fb44acc1389b53dcc0cefb66a22
SHA1 4f81ba457c8089235529efde876a431bd8a3228e
SHA512 2a7ce0b55731fbd2f3e28f980ae0381fd3c4e3410a2c622417f977595b00910c826843150eaaffe144464c1478d03f98733da0883df5d4a84459ee1e36b9258a
SSDEEP 98304:wkGQg1LS4hPbU/llpwXHaT2YI3z5oNfMcI:HGP1LS4hPw/llpwXHaT2p3UfMcI
TLSH
T144664A12FCA205F6C2BEF5348256E322BA7138A543313BD75F9496671666FE07A3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads