Analysis
- max time kernel
148s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
21/08/2026, 04:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe
- Size 5.6MB
- Sample260821-e7adrsw1ev
- SHA256 b9f8ae4a9957bc2e73616a7fe690273783da79dc83a66c68d4c6b6ed3a81b5bc
- MD5 5539bfb58d42d6e8aa619263df43f2cd
- SHA1 c7967ab88bbe406b63c2717eed0826c4b077207a
- SHA512 006476adb53ba426f29a848de37449c92b438b0e97e16ac468177aec5ef7b6c3df695deb8d613539fed21b1be3ec26284909d21a4b1beeb18dba854b3c17213c
- SSDEEP 98304:gw+sy5q1SGkDwVBTwPwYqwjsCkpL2OPX:l+D5q1SGs2ycwtkpq
- TLSH T11346C697A99240E6CF6FE1B641C0D3A23B727C4D07626F936E5087970A56AF4372E730
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bzTamsd = "c:\\Windows\\System32\\bzTamsd.exe" 2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wIn = "c:\\Windows\\System32\\wIn.exe" 2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "c:\\Windows\\System32\\.exe" 2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe - Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created \??\c:\Windows\System32\bzTamsd.exe 2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe File created \??\c:\Windows\System32\wIn.exe 2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe File created \??\c:\Windows\System32\.exe 2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ul-phn.xrm-ms 2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\TellMeWord.nrr.exe 2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Windows.dll 2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.MashupEngine.dll 2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\AdHocReportingExcelClient.dll 2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\CONFLICT.ICO 2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\hu\msipc.dll.mui.exe 2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\Welcome.html 2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalDemoR_BypassTrial180-ul-oob.xrm-ms 2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-pl.xrm-ms 2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\POSTS.ICO 2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_flat_10_000000_40x100.png 2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe File created C:\Program Files\Windows Defender\ja-JP\MsMpRes.dll.mui.exe 2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe File created C:\Program Files\Common Files\System\Ole DB\it-IT\oledb32r.dll.mui.exe 2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ul-phn.xrm-ms 2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-pl.xrm-ms 2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\mashupcompression.dll.exe 2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\as80.xsl.exe 2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-80.png 2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SAEXT.DLL 2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\msvcp120.dll.exe 2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe File created C:\Program Files\7-Zip\Lang\co.txt.exe 2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe File opened for modification C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB 2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\sound.properties 2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-180.png 2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\MLCFG32.CPL.exe 2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSO.FRAMEPROTOCOLWIN32.DLL 2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\ODBCMESSAGES.XML 2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\en\SpreadsheetIQ.Diagram.Resources.dll.exe 2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe File created C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui 2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\optimization_guide_internal.dll.exe 2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-synch-l1-1-0.dll 2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.fr-fr.xml.exe 2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ul-phn.xrm-ms 2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\Cultures\OFFICE.ODF 2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.FileUtils.dll 2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationClientsideProviders.resources.dll.exe 2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe File created C:\Program Files\Java\jre-1.8\bin\t2k.dll.exe 2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_Grace-ul-oob.xrm-ms.exe 2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\OutlookAutoDiscover\YAHOO.NO.XML.exe 2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL083.XML 2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\api-ms-win-crt-heap-l1-1-0.dll.exe 2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\msvcr120.dll 2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe File opened for modification C:\Program Files\Mozilla Firefox\ipcclientcerts.dll 2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationClientsideProviders.resources.dll.exe 2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.onenotemui.msi.16.en-us.xml.exe 2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\hr.pak 2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll 2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_OEM_Perp-ul-phn.xrm-ms.exe 2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ul-phn.xrm-ms 2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OutlookLogo.contrast-black_scale-180.png.exe 2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\mecontrol.png 2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\WPGIMP32.FLT 2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.uk-ua.dll.exe 2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngcc.md.exe 2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ul-oob.xrm-ms.exe 2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CONCRETE\CONCRETE.ELM 2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe.exe 2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\librawvid_plugin.dll 2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\kn_NEUTER.pak 2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ppd.xrm-ms 2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\DOC.CFG 2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-black_scale-80.png 2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\Microsoft.Build.Utilities.v3.5.resources.dll 2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-21_5539bfb58d42d6e8aa619263df43f2cd_cobalt-strike_coinminer_glassworm_poet-rat_snatch.exe"1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
PID:1224
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7-zip.dll.exe
- Size 5.7MB
- SHA256 88f242ad28ca83e12e3ca2eecfc0aac85823af269377addffe719e43035aff4f
- MD5 17257e068ba56e9e3673112faa39823a
- SHA1 d6d4a2834f08f19b9fbda63dd962416353d53c75
- SHA512 f562311d9daa8071027b7ee6601348c223786de2a1e678a49fd1bed1a97df8af8f108fde69d0c863f6eebd2a6c0f7d5d8f3ece79087d42fa7580ae13681d019e
- SSDEEP 98304:gw+sy5q1SGkDwVBTwPwYqwjsCkpL2OPX2:l+D5q1SGs2ycwtkpqR
- TLSH T14456C697A99240E6CF6FE1B641C0D3A23B727C4D07626F936E5087970A56AF4372E730
- MD5 SHA1 SHA512 SSDEEP TLSH