Analysis
- max time kernel
148s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 14:44
Behavioral task
behavioral1
Sample
2026-08-04_a000942b54dbd1669a93688181123d61_cobalt-strike_coinminer_glassworm_poet-rat.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-04_a000942b54dbd1669a93688181123d61_cobalt-strike_coinminer_glassworm_poet-rat.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-08-04_a000942b54dbd1669a93688181123d61_cobalt-strike_coinminer_glassworm_poet-rat.exe
- Size 9.8MB
- Sample260804-r4fgtscd76
- SHA256 732029f7036ddac31baabb627f3f456fdd88693db76d243d0d028cb124bbcdc9
- MD5 a000942b54dbd1669a93688181123d61
- SHA1 42111ada58567d8cec161cbec40df3f4c7f463e2
- SHA512 413d2bfea01238f972d58a4a183569b94a586ba79c33fd049d02e4910d95a803d690c2290c3b0acb2dca8abf67e1bbc786357cbe50b3e8bd9d2b2f05474be7a4
- SSDEEP 196608:VmD5q1SGs2y7QNTpWLhR4hRbhRFhR7hR8hRt:4A+FRERtRHRNRgRt
- TLSH T1AAA6BF32F6E505EAC6FFE274C05142217EB178675336BB8B5F8055AA1D23BD0AD2E312
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
gravityrat
C2
-
https://ent34ndx3cz8k.x.pipedream.net
Signatures
- Family: GravityRAT
GravityRAT is a cross-platform malware an Android, macOS and Windows based RAT first seen in 2015.
- Detects executables referencing virtualization MAC addresses 1 IoCs
resource yara_rule behavioral2/files/0x0009000000019cc9-4.dat INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb - Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-08-04_a000942b54dbd1669a93688181123d61_cobalt-strike_coinminer_glassworm_poet-rat.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created \??\c:\Windows\System32\jZShyV.exe 2026-08-04_a000942b54dbd1669a93688181123d61_cobalt-strike_coinminer_glassworm_poet-rat.exe File created \??\c:\Windows\System32\aYJRUNPn.exe 2026-08-04_a000942b54dbd1669a93688181123d61_cobalt-strike_coinminer_glassworm_poet-rat.exe File created \??\c:\Windows\System32\r.exe 2026-08-04_a000942b54dbd1669a93688181123d61_cobalt-strike_coinminer_glassworm_poet-rat.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-100.png.exe 2026-08-04_a000942b54dbd1669a93688181123d61_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OIMG.DLL 2026-08-04_a000942b54dbd1669a93688181123d61_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL119.XML.exe 2026-08-04_a000942b54dbd1669a93688181123d61_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\RECALL.DLL 2026-08-04_a000942b54dbd1669a93688181123d61_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.DirectoryServices.AccountManagement.dll 2026-08-04_a000942b54dbd1669a93688181123d61_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\el_FEMININE.pak.exe 2026-08-04_a000942b54dbd1669a93688181123d61_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\j2pcsc.dll.exe 2026-08-04_a000942b54dbd1669a93688181123d61_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Office Theme.thmx 2026-08-04_a000942b54dbd1669a93688181123d61_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\SOLVER.XLAM 2026-08-04_a000942b54dbd1669a93688181123d61_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\adal.dll.exe 2026-08-04_a000942b54dbd1669a93688181123d61_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\tmapi_xl.dll.exe 2026-08-04_a000942b54dbd1669a93688181123d61_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUECALM\BLUECALM.ELM.exe 2026-08-04_a000942b54dbd1669a93688181123d61_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_chroma\librv32_plugin.dll 2026-08-04_a000942b54dbd1669a93688181123d61_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription4-ppd.xrm-ms.exe 2026-08-04_a000942b54dbd1669a93688181123d61_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\Office16\OutlookAutoDiscover\BTINTERNET.NET.XML.exe 2026-08-04_a000942b54dbd1669a93688181123d61_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SONORA\SONORA.ELM 2026-08-04_a000942b54dbd1669a93688181123d61_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libcroppadd_plugin.dll.exe 2026-08-04_a000942b54dbd1669a93688181123d61_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_output\libwinhibit_plugin.dll 2026-08-04_a000942b54dbd1669a93688181123d61_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.da-dk.dll.exe 2026-08-04_a000942b54dbd1669a93688181123d61_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_zh_CN.properties 2026-08-04_a000942b54dbd1669a93688181123d61_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Median.xml 2026-08-04_a000942b54dbd1669a93688181123d61_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Trial-ul-oob.xrm-ms.exe 2026-08-04_a000942b54dbd1669a93688181123d61_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\ColleagueImport.dll.exe 2026-08-04_a000942b54dbd1669a93688181123d61_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\api-ms-win-crt-private-l1-1-0.dll.exe 2026-08-04_a000942b54dbd1669a93688181123d61_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_splitter\libclone_plugin.dll 2026-08-04_a000942b54dbd1669a93688181123d61_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.it-it.dll 2026-08-04_a000942b54dbd1669a93688181123d61_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\gu_MASCULINE.pak 2026-08-04_a000942b54dbd1669a93688181123d61_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ul.xrm-ms.exe 2026-08-04_a000942b54dbd1669a93688181123d61_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TEXTCONV\WPFT532.CNV 2026-08-04_a000942b54dbd1669a93688181123d61_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SATIN\SATIN.INF 2026-08-04_a000942b54dbd1669a93688181123d61_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationProvider.dll 2026-08-04_a000942b54dbd1669a93688181123d61_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightRegular.ttf 2026-08-04_a000942b54dbd1669a93688181123d61_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-heap-l1-1-0.dll 2026-08-04_a000942b54dbd1669a93688181123d61_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\GOTHICI.TTF.exe 2026-08-04_a000942b54dbd1669a93688181123d61_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\VideoLAN\VLC\lua\http\images\Video-48.png.exe 2026-08-04_a000942b54dbd1669a93688181123d61_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Windows Defender\MpAzSubmit.dll 2026-08-04_a000942b54dbd1669a93688181123d61_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-ul-phn.xrm-ms 2026-08-04_a000942b54dbd1669a93688181123d61_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GKWord.dll 2026-08-04_a000942b54dbd1669a93688181123d61_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WordInterProviderRanker.bin 2026-08-04_a000942b54dbd1669a93688181123d61_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RMNSQUE\PREVIEW.GIF 2026-08-04_a000942b54dbd1669a93688181123d61_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\vlc.mo.exe 2026-08-04_a000942b54dbd1669a93688181123d61_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\vlc.mo.exe 2026-08-04_a000942b54dbd1669a93688181123d61_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libyuy2_i422_plugin.dll 2026-08-04_a000942b54dbd1669a93688181123d61_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Common Files\microsoft shared\ink\zh-TW\tipresx.dll.mui.exe 2026-08-04_a000942b54dbd1669a93688181123d61_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Internet Explorer\iexplore.exe 2026-08-04_a000942b54dbd1669a93688181123d61_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\colorimaging.md 2026-08-04_a000942b54dbd1669a93688181123d61_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\hive.xsl 2026-08-04_a000942b54dbd1669a93688181123d61_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OFFSYML.TTF 2026-08-04_a000942b54dbd1669a93688181123d61_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoianetutil.dll 2026-08-04_a000942b54dbd1669a93688181123d61_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 2026-08-04_a000942b54dbd1669a93688181123d61_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\vlc.mo 2026-08-04_a000942b54dbd1669a93688181123d61_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll.exe 2026-08-04_a000942b54dbd1669a93688181123d61_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\bn_NEUTER.pak.exe 2026-08-04_a000942b54dbd1669a93688181123d61_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe.exe 2026-08-04_a000942b54dbd1669a93688181123d61_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Document.dll 2026-08-04_a000942b54dbd1669a93688181123d61_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Services.Client.resources.dll 2026-08-04_a000942b54dbd1669a93688181123d61_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\intf\http.luac 2026-08-04_a000942b54dbd1669a93688181123d61_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_output\libwasapi_plugin.dll 2026-08-04_a000942b54dbd1669a93688181123d61_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Windows Defender\fr-FR\shellext.dll.mui 2026-08-04_a000942b54dbd1669a93688181123d61_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Common Files\System\Ole DB\msdatl3.dll.exe 2026-08-04_a000942b54dbd1669a93688181123d61_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\zh-CN_MASCULINE.pak 2026-08-04_a000942b54dbd1669a93688181123d61_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Internet Explorer\uk-UA\iexplore.exe.mui.exe 2026-08-04_a000942b54dbd1669a93688181123d61_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription3-ppd.xrm-ms.exe 2026-08-04_a000942b54dbd1669a93688181123d61_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense2019_eula.txt.exe 2026-08-04_a000942b54dbd1669a93688181123d61_cobalt-strike_coinminer_glassworm_poet-rat.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_a000942b54dbd1669a93688181123d61_cobalt-strike_coinminer_glassworm_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_a000942b54dbd1669a93688181123d61_cobalt-strike_coinminer_glassworm_poet-rat.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
PID:4108
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7-zip.dll.exe
- Size 10.4MB
- SHA256 3a1beca275342db0461781e88004194ba22460f14d44d967e2fb30dd1f72a224
- MD5 bff80a9764c4f977881d6c1baf1163c0
- SHA1 69045610c403a2530a2aeb72a1834dfffb8feaf8
- SHA512 51a981414137595f05955f35fa52ea1066bb14784dede60628a0c8592a41b4590925f8a75da90d456b793632b744dad9350e0b85b43d292839d365d9464524dd
- SSDEEP 196608:VmD5q1SGs2y7QNTpWLhR4hRbhRFhR7hR8hRehRO:4A+FRERtRHRNRgR6RO
- TLSH T12EB6AF32F6E405EAC6BFE274C05242217EB178675336FB8B5F8055AA1D63BD0AD2D312
- MD5 SHA1 SHA512 SSDEEP TLSH