65deea81c64a1a6128f70ef91e283bf8df6ac63534de448110a0d98026a83216

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 23:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-28_2a475fb44acc1389b53dcc0cefb66a22_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
Size 6.4MB
Sample260628-3pr3vsgx3w
SHA256 65deea81c64a1a6128f70ef91e283bf8df6ac63534de448110a0d98026a83216
MD5 2a475fb44acc1389b53dcc0cefb66a22
SHA1 4f81ba457c8089235529efde876a431bd8a3228e
SHA512 2a7ce0b55731fbd2f3e28f980ae0381fd3c4e3410a2c622417f977595b00910c826843150eaaffe144464c1478d03f98733da0883df5d4a84459ee1e36b9258a
SSDEEP 98304:wkGQg1LS4hPbU/llpwXHaT2YI3z5oNfMcI:HGP1LS4hPw/llpwXHaT2p3UfMcI
TLSH
T144664A12FCA205F6C2BEF5348256E322BA7138A543313BD75F9496671666FE07A3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4092	MsMpEng.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\Defender\MsMpEng.exe	2026-06-28_2a475fb44acc1389b53dcc0cefb66a22_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
File opened for modification	C:\Windows\Defender\MsMpEng.exe	2026-06-28_2a475fb44acc1389b53dcc0cefb66a22_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
File created	C:\Windows\Defender\MsMpEng.dll	2026-06-28_2a475fb44acc1389b53dcc0cefb66a22_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
File opened for modification	C:\Windows\Defender\Defender.dll	2026-06-28_2a475fb44acc1389b53dcc0cefb66a22_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
File created	C:\Windows\Defender\MsMpEng.exe	MsMpEng.exe
File opened for modification	C:\Windows\Defender\Defender.dll	MsMpEng.exe

GoLang User-Agent 5 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	3	Go-http-client/1.1
HTTP User-Agent header	5	Go-http-client/1.1
HTTP User-Agent header	15	Go-http-client/1.1
HTTP User-Agent header	20	Go-http-client/1.1
HTTP User-Agent header	23	Go-http-client/1.1

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5928	sChTAsks.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4728 wrote to memory of 6448	4728	2026-06-28_2a475fb44acc1389b53dcc0cefb66a22_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe	91
PID 4728 wrote to memory of 5928	4728	2026-06-28_2a475fb44acc1389b53dcc0cefb66a22_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe	92
PID 4092 wrote to memory of 2400	4092	MsMpEng.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-06-28_2a475fb44acc1389b53dcc0cefb66a22_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-28_2a475fb44acc1389b53dcc0cefb66a22_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4728
- C:\Windows\system32\sCHtAsks.exe
  sCHtAsks.exe /query /tn WindowsDefenderScan
  2⤵
  PID:6448
- C:\Windows\system32\sChTAsks.exe
  sChTAsks.exe /create /xml C:\Users\Admin\AppData\Local\Temp\krebsonsecurity.xml /tn WindowsDefenderScan
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5928

C:\Windows\Defender\MsMpEng.exe
C:\Windows\Defender\MsMpEng.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4092
- C:\Windows\System32\sCHtAsks.exe
  sCHtAsks.exe /query /tn WindowsDefenderScan
  2⤵
  PID:2400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

krebsonsecurity.xml

Path C:\Users\Admin\AppData\Local\Temp\krebsonsecurity.xml
Size 1KB
SHA256 038d08516deffd7769e5923d3d4c41c74843a387a7f9aee5353b1d1e3e07983e
MD5 b679f43e10b19e85edd9fd17f4c8f29b
SHA1 58470c1ba3d42232fc87500f737f25182c30a72d
SHA512 41b0c32aa58da1222b7154185b36d24aeaa5268b7137534e6cb5fc0112fb8499b96a1597cd35b158b80dd896c474cb18bf67d1df83535937194db11fc656a94b
TLSH
T1C331DF64E8F0F35BB252662893512A835F6A87B381558134F8CC4A7C6F8F685615353B
MD5 SHA1 SHA512 TLSH

Submit Download

Defender.dll

Path C:\Windows\Defender\Defender.dll
Size 33B
SHA256 04d2775213b3cf7daa046700c7a0db8e18422511e07c549f1326f8e56e17fc30
MD5 953b34ccfe1763d3433b9af2319c8da7
SHA1 ce376afa25e3e44637d505c99a070dd764fa1dc4
SHA512 d0cbf218d175e3788781843774d3c3cc140399d7c6150565bfc67ae4cdbff94bc829b3238d1e0aa4a175731a25821523fca69d4ac360109e45cd024bcc3a5749
MD5 SHA1 SHA512

Submit Download

MsMpEng.dll

Path C:\Windows\Defender\MsMpEng.dll
Size 3KB
SHA256 a27a5593896e072b75e4685788b93d33b1d2cbdc00cf77fc06db42626c1c4f88
MD5 a2a9d71541880d6fbb9a18a913a9e4a6
SHA1 baec12b79a4e62d9dee7b4d14ba2999cca61d606
SHA512 e10da64e25043968e676a299d3b32d0750f650de812888a9f0f55897dc63b56ced86f0460b95360ed5163c9270db9e221f1a907749afc60228537293925bf8d7
TLSH
T1C8713C563C0029455F3885D5B9086039B234EF0AECAEECD74AB925F8644F49251EE3D9
MD5 SHA1 SHA512 TLSH

Submit Download

MsMpEng.exe

Path C:\Windows\Defender\MsMpEng.exe
Size 6.4MB
SHA256 65deea81c64a1a6128f70ef91e283bf8df6ac63534de448110a0d98026a83216
MD5 2a475fb44acc1389b53dcc0cefb66a22
SHA1 4f81ba457c8089235529efde876a431bd8a3228e
SHA512 2a7ce0b55731fbd2f3e28f980ae0381fd3c4e3410a2c622417f977595b00910c826843150eaaffe144464c1478d03f98733da0883df5d4a84459ee1e36b9258a
SSDEEP 98304:wkGQg1LS4hPbU/llpwXHaT2YI3z5oNfMcI:HGP1LS4hPw/llpwXHaT2p3UfMcI
TLSH
T144664A12FCA205F6C2BEF5348256E322BA7138A543313BD75F9496671666FE07A3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads