Analysis
- max time kernel
150s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 06:28
Behavioral task
behavioral1
Sample
2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
- Size 12.4MB
- Sample260808-g8hsmsvyd1
- SHA256 084e4e6e6be1a5c325f969af13c7d396d8884c06dc190685588e7358cd471c00
- MD5 90efa4cdf9b7271b4476db3acf54e529
- SHA1 3876c8087eefc16d15966917c9024762d547cfc7
- SHA512 130fb5f99808d377c444bda85b2a0bfe1556f3206a01f65781fb9c7bbabd7689884c2fa11413c358e7e33d61993cbb6667c44b9d07ce368dab18fc7ed4ceb961
- SSDEEP 196608:I+D5q1SGs2yRwtkpqShRBhRhhRQhRkhRAhRMhRyhRjhRWhRJ:DAkLRLRrRMR4R8RwRWRFRCRJ
- TLSH T1BFD6B032B6E445AAC2BFE274C06206217FB1B8675326FB8B5F8055ED1D63BD0AD19313
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
gravityrat
C2
-
https://ent34ndx3cz8k.x.pipedream.net
-
.b17da333ec194ec4b767.d.requestbin.net
Signatures
- Family: GravityRAT
GravityRAT is a cross-platform malware an Android, macOS and Windows based RAT first seen in 2015.
- Detects executables referencing virtualization MAC addresses 1 IoCs
resource yara_rule behavioral2/files/0x000a00000001c81e-4.dat INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\oLFYo = "c:\\Windows\\System32\\oLFYo.exe" 2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qv = "c:\\Windows\\System32\\qv.exe" 2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\B = "c:\\Windows\\System32\\B.exe" 2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe - Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created \??\c:\Windows\System32\oLFYo.exe 2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created \??\c:\Windows\System32\qv.exe 2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created \??\c:\Windows\System32\B.exe 2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt 2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_KMS_Client-ul.xrm-ms 2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.Common.FrontEnd.XmlSerializers.dll 2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\hr\msipc.dll.mui.exe 2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA\libssl-1_1-x64.dll 2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vreg\outlookmui.msi.16.en-us.vreg.dat 2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Windows Defender\MpCmdRun.exe 2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue.xml 2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription2-pl.xrm-ms.exe 2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MML2OMML.XSL 2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL109.XML 2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Framework.dll 2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\lua\meta\art\03_lastfm.luac.exe 2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sl-si.dll.exe 2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\gu_FEMININE.pak 2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-ul-oob.xrm-ms 2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\TellMeOutlookTask.nrr.exe 2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-file-l2-1-0.dll.exe 2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PIXEL\THMBNAIL.PNG.exe 2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Infragistics2.Win.UltraWinToolbars.v11.1.dll 2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\SHELLNEW\EXCEL12.XLSX.exe 2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-pl.xrm-ms 2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\CONTACTL.ICO.exe 2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL093.XML.exe 2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE.exe 2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\osmia32.msi 2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\PresentationCore.resources.dll 2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\7-Zip\Lang\sr-spl.txt.exe 2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml 2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ink\mk-MK\tipresx.dll.mui.exe 2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Client\C2R32.dll.exe 2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\1033\VVIEWRES.DLL.exe 2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Windows Defender\en-US\OfflineScannerShell.exe.mui 2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Trial-pl.xrm-ms 2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-pl.xrm-ms.exe 2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.ProgressiveProcessing.dll.exe 2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-140.png 2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libprefetch_plugin.dll.exe 2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-ppd.xrm-ms.exe 2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ul.xrm-ms.exe 2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\+Connect to New Data Source.odc.exe 2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\GKWord.dll.exe 2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OARTODF.DLL 2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Help\Hx.HxT 2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-CA\tipresx.dll.mui.exe 2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ink\pl-PL\tipresx.dll.mui 2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\VisualElements\Logo.png 2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-util-l1-1-0.dll.exe 2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-console-l1-2-0.dll 2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunec.jar 2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l1-1-0.dll.exe 2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\SCNPST32.DLL.exe 2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\bn_FEMININE.pak.exe 2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ul-phn.xrm-ms.exe 2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\Default.dotx.exe 2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\en-us\msipc.dll.mui 2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\METCONV.TXT.exe 2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Windows Defender\AmStatusInstall.mof 2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\es_NEUTER.pak 2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\javafx.properties.exe 2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Layout.dll 2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\OutlookAutoDiscover\YAHOO.JP.XML.exe 2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_90efa4cdf9b7271b4476db3acf54e529_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe"1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
PID:6676
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7-zip.dll.exe
- Size 13.1MB
- SHA256 d2ee9fe85ff8eab3c0fca635ab2efe6841e47f74f896ad0f5c5bdc717fe6dee6
- MD5 41951f36a9de79a726ea5b66bff9e776
- SHA1 01d16a517fadc4e606da3ae41b6bd8a69d2b7f62
- SHA512 d7bcbe3a7c344f4c197758214b489a3e3d12ce6aae639328d0240ecd2e9ce6bc9c2f77cf8a0a26a70158b5731aff3cd0fdd3bbdaf97d7829bfa24e4e3f374ad7
- SSDEEP 196608:I+D5q1SGs2yRwtkpqShRBhRhhRQhRkhRAhRMhRyhRjhRWhRKhRt:DAkLRLRrRMR4R8RwRWRFRCReRt
- TLSH T178D6B032B6E449AAC2BFD274C06206227FB1B8675326FB8B5F8055ED1D53BD0AD19313
- MD5 SHA1 SHA512 SSDEEP TLSH