Analysis
- max time kernel
148s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 05:50
Behavioral task
behavioral1
Sample
2026-08-02_8c73438a1911f08df1addb477f64f78c_cobalt-strike_coinminer_glassworm_poet-rat.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_8c73438a1911f08df1addb477f64f78c_cobalt-strike_coinminer_glassworm_poet-rat.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-08-02_8c73438a1911f08df1addb477f64f78c_cobalt-strike_coinminer_glassworm_poet-rat.exe
- Size 9.1MB
- Sample260802-gjsasadh62
- SHA256 5b96296b2c673991391232628a5ca592ef3857ce7e4f3d79474a7f073ad8e78d
- MD5 8c73438a1911f08df1addb477f64f78c
- SHA1 0ba4ec80445c819f5691eca300e56678d5ab1b81
- SHA512 c88be7cf4a7a3714b07a562b8883c32e0b5ad678efac3d6849775beabd96c95d1218f2dd9a2f7acf90235698786407bee942a7626c87c0be8e12e48108dd4403
- SSDEEP 196608:VmD5q1SGs2y7QNTpWLhR4hRbhRFhR7hRy:4A+FRERtRHRNRy
- TLSH T116A6AF32F5E509EAC6BFE174C15252227EB17C674332BB875F8055AA1E23BD0AD2E311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
gravityrat
C2
-
https://ent34ndx3cz8k.x.pipedream.net
Signatures
- Family: GravityRAT
GravityRAT is a cross-platform malware an Android, macOS and Windows based RAT first seen in 2015.
- Detects executables referencing virtualization MAC addresses 1 IoCs
resource yara_rule behavioral2/files/0x000e00000001c3bd-4.dat INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb - Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-08-02_8c73438a1911f08df1addb477f64f78c_cobalt-strike_coinminer_glassworm_poet-rat.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created \??\c:\Windows\System32\l.exe 2026-08-02_8c73438a1911f08df1addb477f64f78c_cobalt-strike_coinminer_glassworm_poet-rat.exe File created \??\c:\Windows\System32\VTpg.exe 2026-08-02_8c73438a1911f08df1addb477f64f78c_cobalt-strike_coinminer_glassworm_poet-rat.exe File created \??\c:\Windows\System32\ZHdZsG.exe 2026-08-02_8c73438a1911f08df1addb477f64f78c_cobalt-strike_coinminer_glassworm_poet-rat.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\sv_FEMININE.pak.exe 2026-08-02_8c73438a1911f08df1addb477f64f78c_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md 2026-08-02_8c73438a1911f08df1addb477f64f78c_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Common.v4.0.Utilities.dll.exe 2026-08-02_8c73438a1911f08df1addb477f64f78c_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\Office16\Custom.propdesc.exe 2026-08-02_8c73438a1911f08df1addb477f64f78c_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\AccessMessageDismissal.txt.exe 2026-08-02_8c73438a1911f08df1addb477f64f78c_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-08-02_8c73438a1911f08df1addb477f64f78c_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libimage_plugin.dll 2026-08-02_8c73438a1911f08df1addb477f64f78c_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe.exe 2026-08-02_8c73438a1911f08df1addb477f64f78c_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial.xml 2026-08-02_8c73438a1911f08df1addb477f64f78c_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial-ul-oob.xrm-ms 2026-08-02_8c73438a1911f08df1addb477f64f78c_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\REMOTEL.ICO.exe 2026-08-02_8c73438a1911f08df1addb477f64f78c_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-08-02_8c73438a1911f08df1addb477f64f78c_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ACEODEXL.DLL.exe 2026-08-02_8c73438a1911f08df1addb477f64f78c_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\URLREDIR.DLL.exe 2026-08-02_8c73438a1911f08df1addb477f64f78c_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sm\LC_MESSAGES\vlc.mo 2026-08-02_8c73438a1911f08df1addb477f64f78c_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\IPM.CFG 2026-08-02_8c73438a1911f08df1addb477f64f78c_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ACEODATA.DLL.exe 2026-08-02_8c73438a1911f08df1addb477f64f78c_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Windows Defender\de-DE\shellext.dll.mui 2026-08-02_8c73438a1911f08df1addb477f64f78c_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Common Files\microsoft shared\ink\am-ET\tipresx.dll.mui 2026-08-02_8c73438a1911f08df1addb477f64f78c_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md.exe 2026-08-02_8c73438a1911f08df1addb477f64f78c_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ul-oob.xrm-ms.exe 2026-08-02_8c73438a1911f08df1addb477f64f78c_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ppd.xrm-ms.exe 2026-08-02_8c73438a1911f08df1addb477f64f78c_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\REFSPCL.TTF 2026-08-02_8c73438a1911f08df1addb477f64f78c_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Microsoft.Excel.SPClient.Interfaces.dll.exe 2026-08-02_8c73438a1911f08df1addb477f64f78c_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Common Files\microsoft shared\ink\micaut.dll.exe 2026-08-02_8c73438a1911f08df1addb477f64f78c_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019DemoR_BypassTrial180-ul-oob.xrm-ms.exe 2026-08-02_8c73438a1911f08df1addb477f64f78c_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Java\jre-1.8\bin\lcms.dll.exe 2026-08-02_8c73438a1911f08df1addb477f64f78c_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Trial-ppd.xrm-ms 2026-08-02_8c73438a1911f08df1addb477f64f78c_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\Office16\REFEDIT.DLL.exe 2026-08-02_8c73438a1911f08df1addb477f64f78c_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\NewCommentRTL.White.png 2026-08-02_8c73438a1911f08df1addb477f64f78c_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.exe 2026-08-02_8c73438a1911f08df1addb477f64f78c_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_Grace-ul-oob.xrm-ms 2026-08-02_8c73438a1911f08df1addb477f64f78c_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-pl.xrm-ms.exe 2026-08-02_8c73438a1911f08df1addb477f64f78c_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GFX.DLL 2026-08-02_8c73438a1911f08df1addb477f64f78c_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Mozilla Firefox\firefox.VisualElementsManifest.xml.exe 2026-08-02_8c73438a1911f08df1addb477f64f78c_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libd3d11va_plugin.dll 2026-08-02_8c73438a1911f08df1addb477f64f78c_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Grace-ppd.xrm-ms.exe 2026-08-02_8c73438a1911f08df1addb477f64f78c_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_logo_large.png 2026-08-02_8c73438a1911f08df1addb477f64f78c_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\BillingStatement.xltx 2026-08-02_8c73438a1911f08df1addb477f64f78c_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\rsod\osmux.x-none.msi.16.x-none.boot.tree.dat.exe 2026-08-02_8c73438a1911f08df1addb477f64f78c_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\as90.xsl 2026-08-02_8c73438a1911f08df1addb477f64f78c_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Infragistics2.Win.UltraWinChart.v11.1.dll.exe 2026-08-02_8c73438a1911f08df1addb477f64f78c_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Common Files\microsoft shared\ink\ca-ES\tipresx.dll.mui.exe 2026-08-02_8c73438a1911f08df1addb477f64f78c_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-08-02_8c73438a1911f08df1addb477f64f78c_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\deploy\messages_ja.properties 2026-08-02_8c73438a1911f08df1addb477f64f78c_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-pl.xrm-ms.exe 2026-08-02_8c73438a1911f08df1addb477f64f78c_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ul.xrm-ms 2026-08-02_8c73438a1911f08df1addb477f64f78c_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-ul-phn.xrm-ms.exe 2026-08-02_8c73438a1911f08df1addb477f64f78c_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA6\VBE6EXT.OLB 2026-08-02_8c73438a1911f08df1addb477f64f78c_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Royale.dll 2026-08-02_8c73438a1911f08df1addb477f64f78c_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\sunec.dll 2026-08-02_8c73438a1911f08df1addb477f64f78c_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.wordmui.msi.16.en-us.xml 2026-08-02_8c73438a1911f08df1addb477f64f78c_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\vlc.mo 2026-08-02_8c73438a1911f08df1addb477f64f78c_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msaddsr.dll.mui 2026-08-02_8c73438a1911f08df1addb477f64f78c_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-private-l1-1-0.dll.exe 2026-08-02_8c73438a1911f08df1addb477f64f78c_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-pl.xrm-ms 2026-08-02_8c73438a1911f08df1addb477f64f78c_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Web.Entity.Resources.dll.exe 2026-08-02_8c73438a1911f08df1addb477f64f78c_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\vlc.mo 2026-08-02_8c73438a1911f08df1addb477f64f78c_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_splitter\libwall_plugin.dll 2026-08-02_8c73438a1911f08df1addb477f64f78c_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll.exe 2026-08-02_8c73438a1911f08df1addb477f64f78c_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe.exe 2026-08-02_8c73438a1911f08df1addb477f64f78c_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\images\cursors\invalid32x32.gif 2026-08-02_8c73438a1911f08df1addb477f64f78c_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml 2026-08-02_8c73438a1911f08df1addb477f64f78c_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_KMS_Client-ul-oob.xrm-ms.exe 2026-08-02_8c73438a1911f08df1addb477f64f78c_cobalt-strike_coinminer_glassworm_poet-rat.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_8c73438a1911f08df1addb477f64f78c_cobalt-strike_coinminer_glassworm_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_8c73438a1911f08df1addb477f64f78c_cobalt-strike_coinminer_glassworm_poet-rat.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
PID:4132
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7-zip.dll.exe
- Size 9.9MB
- SHA256 ec802387de260759af3f926653419cdb9b2496a1d0a4ec226a7bc1053e2bb30c
- MD5 9fd4892daa1f9f949366bdc9b8f05104
- SHA1 0720848d2b8b171638684b8bcbd58b2255405725
- SHA512 881981fbc3983b404f42cbcb5b1effa98a71ffaedb0e09a5d6184810188958ede3404683030bee40bb76dd214ff1be80cb1b7c4f9e5b65d42dbff7e86c833996
- SSDEEP 196608:VmD5q1SGs2y7QNTpWLhR4hRbhRFhR7hRvhRX:4A+FRERtRHRNR5RX
- TLSH T16EA6BF32F6E505EAC6BFE274C05142217EB178675336FB8B5F8055AA1D23BD0AD2E312
- MD5 SHA1 SHA512 SSDEEP TLSH