Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
12/08/2026, 04:28
Behavioral task
behavioral1
Sample
2026-08-12_b0d59668efd34d7ff98d4136f442b127_cobalt-strike_coinminer_glassworm_poet-rat.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-12_b0d59668efd34d7ff98d4136f442b127_cobalt-strike_coinminer_glassworm_poet-rat.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-08-12_b0d59668efd34d7ff98d4136f442b127_cobalt-strike_coinminer_glassworm_poet-rat.exe
- Size 12.2MB
- Sample260812-e3netsal7t
- SHA256 0435c2e0d25a10b35e0924f089abc03f2de45eacd5db24f0421449794f6dfccc
- MD5 b0d59668efd34d7ff98d4136f442b127
- SHA1 63253ce3468ec7fc4d56fd0aceb814770c889338
- SHA512 48ea59f1852898d1fd431dd1095ff8fbd76ea6e9e4d29bd7dbd5c5acb865197a56f2ff1e1c64914fd9ac285fcd78877eff61656e37e8caf74ea3f2a256d8e61e
- SSDEEP 196608:VmD5q1SGs2y7QNTpWLhR4hRmhRihRMhRchRPhR3hRehRs:4A+FRERSRGRwRARZRxR6Rs
- TLSH T140D6B032B6E409AAC6FFE274C06206227EB178675336FB8B5F8055E91D53BD0AD19313
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
gravityrat
C2
-
https://ent34ndx3cz8k.x.pipedream.net
Signatures
- Family: GravityRAT
GravityRAT is a cross-platform malware an Android, macOS and Windows based RAT first seen in 2015.
- Detects executables referencing virtualization MAC addresses 1 IoCs
resource yara_rule behavioral1/files/0x000300000001e6d4-4.dat INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb - Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-08-12_b0d59668efd34d7ff98d4136f442b127_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\desktop.ini 2026-08-12_b0d59668efd34d7ff98d4136f442b127_cobalt-strike_coinminer_glassworm_poet-rat.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created \??\c:\Windows\System32\xpedyY.exe 2026-08-12_b0d59668efd34d7ff98d4136f442b127_cobalt-strike_coinminer_glassworm_poet-rat.exe File created \??\c:\Windows\System32\tEMce.exe 2026-08-12_b0d59668efd34d7ff98d4136f442b127_cobalt-strike_coinminer_glassworm_poet-rat.exe File created \??\c:\Windows\System32\wfU.exe 2026-08-12_b0d59668efd34d7ff98d4136f442b127_cobalt-strike_coinminer_glassworm_poet-rat.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Infragistics2.Win.UltraWinGrid.v11.1.dll 2026-08-12_b0d59668efd34d7ff98d4136f442b127_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Windows Defender\uk-UA\MsMpRes.dll.mui.exe 2026-08-12_b0d59668efd34d7ff98d4136f442b127_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\Weather_TileSmallSquare.scale-200.png 2026-08-12_b0d59668efd34d7ff98d4136f442b127_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\images\illustration-UploadToOD.svg 2026-08-12_b0d59668efd34d7ff98d4136f442b127_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml.exe 2026-08-12_b0d59668efd34d7ff98d4136f442b127_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL118.XML.exe 2026-08-12_b0d59668efd34d7ff98d4136f442b127_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\vreg\powerpoint.x-none.msi.16.x-none.vreg.dat 2026-08-12_b0d59668efd34d7ff98d4136f442b127_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Cortana.dll.exe 2026-08-12_b0d59668efd34d7ff98d4136f442b127_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-48_altform-unplated.png.exe 2026-08-12_b0d59668efd34d7ff98d4136f442b127_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-30_altform-unplated_contrast-black.png.exe 2026-08-12_b0d59668efd34d7ff98d4136f442b127_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\System.Windows.Forms.Design.resources.dll 2026-08-12_b0d59668efd34d7ff98d4136f442b127_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN097.XML.exe 2026-08-12_b0d59668efd34d7ff98d4136f442b127_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE.exe 2026-08-12_b0d59668efd34d7ff98d4136f442b127_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\images\AppExcel32x32.png 2026-08-12_b0d59668efd34d7ff98d4136f442b127_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-256_altform-unplated_contrast-white.png.exe 2026-08-12_b0d59668efd34d7ff98d4136f442b127_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\System\msvcp100.dll 2026-08-12_b0d59668efd34d7ff98d4136f442b127_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\PresentationBuildTasks.resources.dll.exe 2026-08-12_b0d59668efd34d7ff98d4136f442b127_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\AppxManifest.xml.exe 2026-08-12_b0d59668efd34d7ff98d4136f442b127_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\en-gb\msointl30_winrt.dll.exe 2026-08-12_b0d59668efd34d7ff98d4136f442b127_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\uk-UA\MSFT_PackageManagement.strings.psd1 2026-08-12_b0d59668efd34d7ff98d4136f442b127_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Common Files\System\Ole DB\ja-JP\msdasqlr.dll.mui.exe 2026-08-12_b0d59668efd34d7ff98d4136f442b127_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-ul-oob.xrm-ms.exe 2026-08-12_b0d59668efd34d7ff98d4136f442b127_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\WideTile.scale-200.png.exe 2026-08-12_b0d59668efd34d7ff98d4136f442b127_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSplashLogo.scale-200.png.exe 2026-08-12_b0d59668efd34d7ff98d4136f442b127_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNewNoteSmallTile.scale-200.png 2026-08-12_b0d59668efd34d7ff98d4136f442b127_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\contrast-white\SmallTile.scale-200.png 2026-08-12_b0d59668efd34d7ff98d4136f442b127_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.Primitives.resources.dll 2026-08-12_b0d59668efd34d7ff98d4136f442b127_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\en-us\oregres.dll.mui 2026-08-12_b0d59668efd34d7ff98d4136f442b127_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Win10\MicrosoftSolitaireWideTile.scale-100.jpg.exe 2026-08-12_b0d59668efd34d7ff98d4136f442b127_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\SharedUI.dll 2026-08-12_b0d59668efd34d7ff98d4136f442b127_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-08-12_b0d59668efd34d7ff98d4136f442b127_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-string-l1-1-0.dll 2026-08-12_b0d59668efd34d7ff98d4136f442b127_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\sbicuuc53_64.dll.exe 2026-08-12_b0d59668efd34d7ff98d4136f442b127_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SplashScreen.scale-100_contrast-white.png 2026-08-12_b0d59668efd34d7ff98d4136f442b127_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\contrast-black\MixedRealityPortalAppList.targetsize-24_altform-unplated_contrast-black.png 2026-08-12_b0d59668efd34d7ff98d4136f442b127_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_neutral_split.scale-100_8wekyb3d8bbwe\resources.pri.exe 2026-08-12_b0d59668efd34d7ff98d4136f442b127_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\InsiderHubSplashWideTile.scale-100_contrast-black.png 2026-08-12_b0d59668efd34d7ff98d4136f442b127_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Xaml.resources.dll 2026-08-12_b0d59668efd34d7ff98d4136f442b127_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Facet.thmx 2026-08-12_b0d59668efd34d7ff98d4136f442b127_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ppd.xrm-ms 2026-08-12_b0d59668efd34d7ff98d4136f442b127_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\8.jpg.exe 2026-08-12_b0d59668efd34d7ff98d4136f442b127_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\AppxManifest.xml.exe 2026-08-12_b0d59668efd34d7ff98d4136f442b127_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.Primitives.resources.dll 2026-08-12_b0d59668efd34d7ff98d4136f442b127_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll 2026-08-12_b0d59668efd34d7ff98d4136f442b127_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Java\jre-1.8\Welcome.html.exe 2026-08-12_b0d59668efd34d7ff98d4136f442b127_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-180.png 2026-08-12_b0d59668efd34d7ff98d4136f442b127_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\WPGIMP32.FLT 2026-08-12_b0d59668efd34d7ff98d4136f442b127_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\69.png 2026-08-12_b0d59668efd34d7ff98d4136f442b127_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square310x310Logo.scale-100.png.exe 2026-08-12_b0d59668efd34d7ff98d4136f442b127_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square310x310Logo.scale-125.png.exe 2026-08-12_b0d59668efd34d7ff98d4136f442b127_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-80_altform-unplated.png.exe 2026-08-12_b0d59668efd34d7ff98d4136f442b127_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsrom.xml 2026-08-12_b0d59668efd34d7ff98d4136f442b127_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\jfr\profile.jfc 2026-08-12_b0d59668efd34d7ff98d4136f442b127_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\rsod\proof.en-us.msi.16.en-us.boot.tree.dat.exe 2026-08-12_b0d59668efd34d7ff98d4136f442b127_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionMedTile.scale-100.png.exe 2026-08-12_b0d59668efd34d7ff98d4136f442b127_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\FrameExtractorPage.xbf 2026-08-12_b0d59668efd34d7ff98d4136f442b127_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\resources.a3fa76ae.pri 2026-08-12_b0d59668efd34d7ff98d4136f442b127_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\PreviewMailList.png.exe 2026-08-12_b0d59668efd34d7ff98d4136f442b127_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\OrientationControlOuterCircleHover.png.exe 2026-08-12_b0d59668efd34d7ff98d4136f442b127_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Windows Media Player\fr-FR\setup_wm.exe.mui.exe 2026-08-12_b0d59668efd34d7ff98d4136f442b127_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\System.ServiceModel.dll.exe 2026-08-12_b0d59668efd34d7ff98d4136f442b127_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\resources.pri.exe 2026-08-12_b0d59668efd34d7ff98d4136f442b127_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psm1 2026-08-12_b0d59668efd34d7ff98d4136f442b127_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Transactions.Local.dll.exe 2026-08-12_b0d59668efd34d7ff98d4136f442b127_cobalt-strike_coinminer_glassworm_poet-rat.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-12_b0d59668efd34d7ff98d4136f442b127_cobalt-strike_coinminer_glassworm_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-12_b0d59668efd34d7ff98d4136f442b127_cobalt-strike_coinminer_glassworm_poet-rat.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
PID:3648
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7-zip.dll.exe
- Size 12.9MB
- SHA256 427856ab38e9c38e2248f565db5ddf0f161115ef1138551bd245638a50ea2c8c
- MD5 645a6c91b1ac53ba74cb771062356aba
- SHA1 4eaf3d60adde35bd78e18217c13ca0a0e7eed2d7
- SHA512 9443ac2b4b906acffe6642ae733fab995458956c9acf371356319ff7558300013b22b1fa9e227ae76c88ffbbd2993bae92b6772fe47c3c1b4ef1367e50b9bd42
- SSDEEP 196608:VmD5q1SGs2y7QNTpWLhR4hRmhRihRMhRchRPhR3hRehRdhRy:4A+FRERSRGRwRARZRxR6RvRy
- TLSH T18CD6C032B6E409AAC6FFD274C06206227EB1B8675326FB8B5F8055ED1D53BD0AD19313
- MD5 SHA1 SHA512 SSDEEP TLSH