Analysis
- max time kernel
148s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/07/2026, 06:51
Behavioral task
behavioral1
Sample
2026-07-20_04e4d1817afb58060b140a83092d5193_cobalt-strike_coinminer_glassworm_poet-rat.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-20_04e4d1817afb58060b140a83092d5193_cobalt-strike_coinminer_glassworm_poet-rat.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-07-20_04e4d1817afb58060b140a83092d5193_cobalt-strike_coinminer_glassworm_poet-rat.exe
- Size 9.9MB
- Sample260720-hml4lsbz4w
- SHA256 e227af2664eb838849f741ecd4f2160f5dc096e5d36c4c19dfd94758480cf76c
- MD5 04e4d1817afb58060b140a83092d5193
- SHA1 6415e215c574d2614969506f09a7528266e6123d
- SHA512 cd94f33ccb230ab1d91980f4e57464ede98355441e0c5d7b8ac0c92e503f57c3f7fc4244bee23c82c42af4023c608416c413797911fae7e40211428b8c3f0d05
- SSDEEP 196608:VmD5q1SGs2y7QNTpWLhR4hRmhRihRMhRchRn:4A+FRERSRGRwRARn
- TLSH T19BA6BF32F6E505EAC6BFE274C05142217EB178675332FB8B5F8055AA1D63BD0AD2E312
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
gravityrat
C2
-
https://ent34ndx3cz8k.x.pipedream.net
Signatures
- Family: GravityRAT
GravityRAT is a cross-platform malware an Android, macOS and Windows based RAT first seen in 2015.
- Detects executables referencing virtualization MAC addresses 1 IoCs
resource yara_rule behavioral2/files/0x000d00000001c554-4.dat INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb - Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-07-20_04e4d1817afb58060b140a83092d5193_cobalt-strike_coinminer_glassworm_poet-rat.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created \??\c:\Windows\System32\oRXkft.exe 2026-07-20_04e4d1817afb58060b140a83092d5193_cobalt-strike_coinminer_glassworm_poet-rat.exe File created \??\c:\Windows\System32\hoG.exe 2026-07-20_04e4d1817afb58060b140a83092d5193_cobalt-strike_coinminer_glassworm_poet-rat.exe File created \??\c:\Windows\System32\SilOst.exe 2026-07-20_04e4d1817afb58060b140a83092d5193_cobalt-strike_coinminer_glassworm_poet-rat.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BOLDSTRI\BOLDSTRI.INF.exe 2026-07-20_04e4d1817afb58060b140a83092d5193_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Mozilla Firefox\ipcclientcerts.dll 2026-07-20_04e4d1817afb58060b140a83092d5193_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\SearchEdit.m1v 2026-07-20_04e4d1817afb58060b140a83092d5193_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fr-fr.dll.exe 2026-07-20_04e4d1817afb58060b140a83092d5193_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.th-th.dll.exe 2026-07-20_04e4d1817afb58060b140a83092d5193_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Java\jre-1.8\lib\security\java.security.exe 2026-07-20_04e4d1817afb58060b140a83092d5193_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\Office16\OSPP.HTM.exe 2026-07-20_04e4d1817afb58060b140a83092d5193_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-pl.xrm-ms.exe 2026-07-20_04e4d1817afb58060b140a83092d5193_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\COMPASS\COMPASS.ELM.exe 2026-07-20_04e4d1817afb58060b140a83092d5193_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_file_plugin.dll 2026-07-20_04e4d1817afb58060b140a83092d5193_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\7-Zip\Lang\io.txt 2026-07-20_04e4d1817afb58060b140a83092d5193_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONGRAPHICS.DLL 2026-07-20_04e4d1817afb58060b140a83092d5193_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7EN.LEX.exe 2026-07-20_04e4d1817afb58060b140a83092d5193_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Routing.dll 2026-07-20_04e4d1817afb58060b140a83092d5193_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\zh-TW_FEMININE.pak 2026-07-20_04e4d1817afb58060b140a83092d5193_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\cldr.md.exe 2026-07-20_04e4d1817afb58060b140a83092d5193_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ppd.xrm-ms 2026-07-20_04e4d1817afb58060b140a83092d5193_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\vlc.mo 2026-07-20_04e4d1817afb58060b140a83092d5193_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Windows Defender\es-ES\ProtectionManagement.dll.mui 2026-07-20_04e4d1817afb58060b140a83092d5193_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\7-Zip\Lang\ga.txt.exe 2026-07-20_04e4d1817afb58060b140a83092d5193_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-ppd.xrm-ms 2026-07-20_04e4d1817afb58060b140a83092d5193_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ppd.xrm-ms 2026-07-20_04e4d1817afb58060b140a83092d5193_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-ppd.xrm-ms 2026-07-20_04e4d1817afb58060b140a83092d5193_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_KMS_Client-ppd.xrm-ms.exe 2026-07-20_04e4d1817afb58060b140a83092d5193_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RIPPLE\PREVIEW.GIF 2026-07-20_04e4d1817afb58060b140a83092d5193_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Windows Defender\de-DE\shellext.dll.mui 2026-07-20_04e4d1817afb58060b140a83092d5193_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\et_FEMININE.pak.exe 2026-07-20_04e4d1817afb58060b140a83092d5193_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MYSL.ICO 2026-07-20_04e4d1817afb58060b140a83092d5193_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\Office16\OutlookAutoDiscover\YAHOO.SE.XML.exe 2026-07-20_04e4d1817afb58060b140a83092d5193_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\ARIALNBI.TTF.exe 2026-07-20_04e4d1817afb58060b140a83092d5193_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\vfs\System\msvcr100.dll.exe 2026-07-20_04e4d1817afb58060b140a83092d5193_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\SystemX86\msvcp140.dll 2026-07-20_04e4d1817afb58060b140a83092d5193_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationClient.resources.dll 2026-07-20_04e4d1817afb58060b140a83092d5193_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Common Files\System\ado\msadox.dll.exe 2026-07-20_04e4d1817afb58060b140a83092d5193_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\ro_MASCULINE.pak.exe 2026-07-20_04e4d1817afb58060b140a83092d5193_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\VisualElements\LogoCanary.png 2026-07-20_04e4d1817afb58060b140a83092d5193_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome.exe.sig.exe 2026-07-20_04e4d1817afb58060b140a83092d5193_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Franklin Gothic.xml.exe 2026-07-20_04e4d1817afb58060b140a83092d5193_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-ppd.xrm-ms 2026-07-20_04e4d1817afb58060b140a83092d5193_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE.exe 2026-07-20_04e4d1817afb58060b140a83092d5193_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\MTEXTRA.TTF 2026-07-20_04e4d1817afb58060b140a83092d5193_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.Targets 2026-07-20_04e4d1817afb58060b140a83092d5193_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ul-phn.xrm-ms.exe 2026-07-20_04e4d1817afb58060b140a83092d5193_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\Office16\CONVERT\OLADD.FAE.exe 2026-07-20_04e4d1817afb58060b140a83092d5193_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000009\FA000000009.exe 2026-07-20_04e4d1817afb58060b140a83092d5193_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\BillingStatement.xltx.exe 2026-07-20_04e4d1817afb58060b140a83092d5193_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATERMAR\WATERMAR.ELM 2026-07-20_04e4d1817afb58060b140a83092d5193_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\OUTFORM.DAT.exe 2026-07-20_04e4d1817afb58060b140a83092d5193_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libhttps_plugin.dll.exe 2026-07-20_04e4d1817afb58060b140a83092d5193_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\7-Zip\Lang\bn.txt.exe 2026-07-20_04e4d1817afb58060b140a83092d5193_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\am_FEMININE.pak.exe 2026-07-20_04e4d1817afb58060b140a83092d5193_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\vlc.mo.exe 2026-07-20_04e4d1817afb58060b140a83092d5193_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\prism_sw.dll 2026-07-20_04e4d1817afb58060b140a83092d5193_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.16.xml 2026-07-20_04e4d1817afb58060b140a83092d5193_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL107.XML.exe 2026-07-20_04e4d1817afb58060b140a83092d5193_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-07-20_04e4d1817afb58060b140a83092d5193_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-ul-oob.xrm-ms.exe 2026-07-20_04e4d1817afb58060b140a83092d5193_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSPECTRE.DLL 2026-07-20_04e4d1817afb58060b140a83092d5193_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\vlm.xml 2026-07-20_04e4d1817afb58060b140a83092d5193_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2native.dll 2026-07-20_04e4d1817afb58060b140a83092d5193_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Grace-ppd.xrm-ms.exe 2026-07-20_04e4d1817afb58060b140a83092d5193_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-ul-phn.xrm-ms.exe 2026-07-20_04e4d1817afb58060b140a83092d5193_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OFFSYMSB.TTF 2026-07-20_04e4d1817afb58060b140a83092d5193_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LAYERS\THMBNAIL.PNG 2026-07-20_04e4d1817afb58060b140a83092d5193_cobalt-strike_coinminer_glassworm_poet-rat.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_04e4d1817afb58060b140a83092d5193_cobalt-strike_coinminer_glassworm_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-20_04e4d1817afb58060b140a83092d5193_cobalt-strike_coinminer_glassworm_poet-rat.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
PID:4340
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7-zip.dll.exe
- Size 10.7MB
- SHA256 d6a11ae8ef7b91b3350ada5b2244f9dff8072acd09f3db01ecb6f0fe785bb89b
- MD5 52177930fa80112b7eccf9128281974d
- SHA1 44238bd51ca6d4a450795ac54d49e9bab1c678bf
- SHA512 d0584fa1fe8b4977b8e7fe0cad2c330128474cc573b1a12f6da308712709f86ba1ad4bb787ebe392a09da99eab06560c62b21a2f46f1d2c3118efce9f625ee1d
- SSDEEP 196608:VmD5q1SGs2y7QNTpWLhR4hRmhRihRMhRchREhRk:4A+FRERSRGRwRARYRk
- TLSH T17DB6BF32F6E405EAC6BFE274C05242217EB178675336FB8B5F8055AA1D63BD0AD2D312
- MD5 SHA1 SHA512 SSDEEP TLSH