Analysis
- max time kernel
148s - max time network
112s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/07/2026, 05:53
Behavioral task
behavioral1
Sample
2026-07-29_15490f6e5d4ad9a2e3a83835531b008a_cobalt-strike_coinminer_glassworm_poet-rat.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-29_15490f6e5d4ad9a2e3a83835531b008a_cobalt-strike_coinminer_glassworm_poet-rat.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-07-29_15490f6e5d4ad9a2e3a83835531b008a_cobalt-strike_coinminer_glassworm_poet-rat.exe
- Size 11.5MB
- Sample260729-glr3sshq2t
- SHA256 0b52739231685ccdab9f0ae25fd3065b8b02958c41615e457404cab181f1adc5
- MD5 15490f6e5d4ad9a2e3a83835531b008a
- SHA1 7ae77864ef4ef6522e86a86849e6caf852da4c76
- SHA512 b3c6a0e0c6f42c8781ce9e5847c8ffd320f89de200f40d67da481d469e58d9e5e883717803ac27a30caffe7b1ab50545f7e4eb1cd90699ed18cf26f74eac1238
- SSDEEP 196608:VmD5q1SGs2y7QNTpWLhR4hRmhRihRMhRchRPhR3hRZ:4A+FRERSRGRwRARZRxRZ
- TLSH T1BDC6B032B6E405AAC6FFE274C05206217EB178675336FB8B5F8055EA1D63BD0AD2D312
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
gravityrat
C2
-
https://ent34ndx3cz8k.x.pipedream.net
Signatures
- Family: GravityRAT
GravityRAT is a cross-platform malware an Android, macOS and Windows based RAT first seen in 2015.
- Detects executables referencing virtualization MAC addresses 1 IoCs
resource yara_rule behavioral2/files/0x000d00000001c3fb-4.dat INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb - Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-07-29_15490f6e5d4ad9a2e3a83835531b008a_cobalt-strike_coinminer_glassworm_poet-rat.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created \??\c:\Windows\System32\.exe 2026-07-29_15490f6e5d4ad9a2e3a83835531b008a_cobalt-strike_coinminer_glassworm_poet-rat.exe File created \??\c:\Windows\System32\NienNoDMN.exe 2026-07-29_15490f6e5d4ad9a2e3a83835531b008a_cobalt-strike_coinminer_glassworm_poet-rat.exe File created \??\c:\Windows\System32\CPECkZtn.exe 2026-07-29_15490f6e5d4ad9a2e3a83835531b008a_cobalt-strike_coinminer_glassworm_poet-rat.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\EXITEM.CFG.exe 2026-07-29_15490f6e5d4ad9a2e3a83835531b008a_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe.exe 2026-07-29_15490f6e5d4ad9a2e3a83835531b008a_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] 2026-07-29_15490f6e5d4ad9a2e3a83835531b008a_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libsvcdsub_plugin.dll 2026-07-29_15490f6e5d4ad9a2e3a83835531b008a_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-pl.xrm-ms 2026-07-29_15490f6e5d4ad9a2e3a83835531b008a_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Exchange.WebServices.dll 2026-07-29_15490f6e5d4ad9a2e3a83835531b008a_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7EN.dub 2026-07-29_15490f6e5d4ad9a2e3a83835531b008a_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\7-Zip\Lang\el.txt.exe 2026-07-29_15490f6e5d4ad9a2e3a83835531b008a_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\7-Zip\Lang\he.txt.exe 2026-07-29_15490f6e5d4ad9a2e3a83835531b008a_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_it.properties.exe 2026-07-29_15490f6e5d4ad9a2e3a83835531b008a_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-ppd.xrm-ms.exe 2026-07-29_15490f6e5d4ad9a2e3a83835531b008a_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-ppd.xrm-ms.exe 2026-07-29_15490f6e5d4ad9a2e3a83835531b008a_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\MSSRINTL.DLL.exe 2026-07-29_15490f6e5d4ad9a2e3a83835531b008a_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\assets\images\MSFT.png.exe 2026-07-29_15490f6e5d4ad9a2e3a83835531b008a_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATER\PREVIEW.GIF 2026-07-29_15490f6e5d4ad9a2e3a83835531b008a_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-07-29_15490f6e5d4ad9a2e3a83835531b008a_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\[email protected] 2026-07-29_15490f6e5d4ad9a2e3a83835531b008a_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial-Times New Roman.xml 2026-07-29_15490f6e5d4ad9a2e3a83835531b008a_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\BUSINESS.ONE 2026-07-29_15490f6e5d4ad9a2e3a83835531b008a_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\MSOXMLMF.DLL.exe 2026-07-29_15490f6e5d4ad9a2e3a83835531b008a_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-heap-l1-1-0.dll.exe 2026-07-29_15490f6e5d4ad9a2e3a83835531b008a_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Entity.Resources.dll.exe 2026-07-29_15490f6e5d4ad9a2e3a83835531b008a_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui.exe 2026-07-29_15490f6e5d4ad9a2e3a83835531b008a_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Common Files\microsoft shared\ink\cy-GB\tipresx.dll.mui.exe 2026-07-29_15490f6e5d4ad9a2e3a83835531b008a_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ExcelNaiveBayesCommandRanker.txt.exe 2026-07-29_15490f6e5d4ad9a2e3a83835531b008a_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\BIN\FPSRVUTL.DLL.exe 2026-07-29_15490f6e5d4ad9a2e3a83835531b008a_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_output\libwingdi_plugin.dll 2026-07-29_15490f6e5d4ad9a2e3a83835531b008a_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\lv_FEMININE.pak.exe 2026-07-29_15490f6e5d4ad9a2e3a83835531b008a_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml 2026-07-29_15490f6e5d4ad9a2e3a83835531b008a_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\vfs\SystemX86\vccorlib140.dll.exe 2026-07-29_15490f6e5d4ad9a2e3a83835531b008a_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\librtp_plugin.dll 2026-07-29_15490f6e5d4ad9a2e3a83835531b008a_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Spatial.NetFX35.dll 2026-07-29_15490f6e5d4ad9a2e3a83835531b008a_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\api-ms-win-core-localization-l1-2-0.dll 2026-07-29_15490f6e5d4ad9a2e3a83835531b008a_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.PasswordManager.dll 2026-07-29_15490f6e5d4ad9a2e3a83835531b008a_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\VideoLAN\VLC\New_Skins.url 2026-07-29_15490f6e5d4ad9a2e3a83835531b008a_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\gu_MASCULINE.pak.exe 2026-07-29_15490f6e5d4ad9a2e3a83835531b008a_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssv.dll 2026-07-29_15490f6e5d4ad9a2e3a83835531b008a_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_PrepidBypass-ppd.xrm-ms.exe 2026-07-29_15490f6e5d4ad9a2e3a83835531b008a_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\flat_officeFontsPreview.ttf 2026-07-29_15490f6e5d4ad9a2e3a83835531b008a_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\mip_clienttelemetry.dll 2026-07-29_15490f6e5d4ad9a2e3a83835531b008a_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\mip_core.dll 2026-07-29_15490f6e5d4ad9a2e3a83835531b008a_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\api-ms-win-crt-convert-l1-1-0.dll.exe 2026-07-29_15490f6e5d4ad9a2e3a83835531b008a_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATERMAR\PREVIEW.GIF 2026-07-29_15490f6e5d4ad9a2e3a83835531b008a_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tabskb.dll.mui.exe 2026-07-29_15490f6e5d4ad9a2e3a83835531b008a_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\fonts\LucidaTypewriterBold.ttf 2026-07-29_15490f6e5d4ad9a2e3a83835531b008a_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-pl.xrm-ms.exe 2026-07-29_15490f6e5d4ad9a2e3a83835531b008a_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_Grace-ul-oob.xrm-ms 2026-07-29_15490f6e5d4ad9a2e3a83835531b008a_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\Sybase.xsl.exe 2026-07-29_15490f6e5d4ad9a2e3a83835531b008a_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSPECTRE.DLL 2026-07-29_15490f6e5d4ad9a2e3a83835531b008a_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\Office16\OutlookAutoDiscover\YAHOO.IE.XML.exe 2026-07-29_15490f6e5d4ad9a2e3a83835531b008a_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.IO.Log.Resources.dll.exe 2026-07-29_15490f6e5d4ad9a2e3a83835531b008a_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ppd.xrm-ms.exe 2026-07-29_15490f6e5d4ad9a2e3a83835531b008a_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLPH.DLL.exe 2026-07-29_15490f6e5d4ad9a2e3a83835531b008a_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\osmdp32.msi.exe 2026-07-29_15490f6e5d4ad9a2e3a83835531b008a_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml.exe 2026-07-29_15490f6e5d4ad9a2e3a83835531b008a_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\vk_swiftshader_icd.json.exe 2026-07-29_15490f6e5d4ad9a2e3a83835531b008a_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\j2pkcs11.dll 2026-07-29_15490f6e5d4ad9a2e3a83835531b008a_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 2026-07-29_15490f6e5d4ad9a2e3a83835531b008a_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Grace-ul-oob.xrm-ms 2026-07-29_15490f6e5d4ad9a2e3a83835531b008a_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ppd.xrm-ms.exe 2026-07-29_15490f6e5d4ad9a2e3a83835531b008a_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-pl.xrm-ms 2026-07-29_15490f6e5d4ad9a2e3a83835531b008a_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\WordR_Grace-ul-oob.xrm-ms 2026-07-29_15490f6e5d4ad9a2e3a83835531b008a_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.exe 2026-07-29_15490f6e5d4ad9a2e3a83835531b008a_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\t2k.dll.exe 2026-07-29_15490f6e5d4ad9a2e3a83835531b008a_cobalt-strike_coinminer_glassworm_poet-rat.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_15490f6e5d4ad9a2e3a83835531b008a_cobalt-strike_coinminer_glassworm_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-29_15490f6e5d4ad9a2e3a83835531b008a_cobalt-strike_coinminer_glassworm_poet-rat.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
PID:5492
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:4992
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7-zip.dll.exe
- Size 12.2MB
- SHA256 da490983de4765aa76cc953278c14678cfccb2c10de782447e4a555c3bc2790c
- MD5 97aea4d8dde027f5fa7bfdb951368db9
- SHA1 4440eed2b23457ed34d61e7c7f1770b4c6b39e51
- SHA512 a04fd97981712ff7496acf036e919fa49982a643aad1a9a673a96e31c095de3642ab975bf5c71703275f8b5c8b861a88ed523c429023ac81a5f5c139db58f901
- SSDEEP 196608:VmD5q1SGs2y7QNTpWLhR4hRmhRihRMhRchRPhR3hR6hRM:4A+FRERSRGRwRARZRxRORM
- TLSH T1C4D6B032B6E409AAC6FFE274C05206227EB178675336FB8B5F8055EA1D53BD0AD19313
- MD5 SHA1 SHA512 SSDEEP TLSH