Analysis
- max time kernel
149s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
21/08/2026, 09:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe
- Size 18.8MB
- Sample260821-lpjcaaxdle
- SHA256 79916ebf1f2577b80b2f3a3a66297b3262d6a95feaa1dc568f1ceb1bfec5090c
- MD5 5bfb26826a5c55748fac0426a96c3147
- SHA1 2d37c94563a32d587c15116744017cbb2fad3ab7
- SHA512 544983c6ca309ea62a06d3c3bdaa13f5ba25aaf0525bc54229079de0305025256757ba6971860f74e820fc64e7c7744ed3b0a07b6e46ec5e8452b84ed9ee2809
- SSDEEP 393216:DAkLRCR3R7R6RLRKRRRcR2R7RQRER2RuRMR6RhRFRm:EQ
- TLSH T18117CF31B7E849AAC2BFD379D06206261EF0B827632AEB4F5E8054FD1D53BD09915363
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NZ = "c:\\Windows\\System32\\NZ.exe" 2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\EW = "c:\\Windows\\System32\\EW.exe" 2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gwxs = "c:\\Windows\\System32\\gwxs.exe" 2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe - Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\desktop.ini 2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created \??\c:\Windows\System32\EW.exe 2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe File created \??\c:\Windows\System32\gwxs.exe 2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe File created \??\c:\Windows\System32\NZ.exe 2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.scale-200_contrast-white.png 2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\LargeTile.scale-200_contrast-white.png 2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\CardUIBkg.scale-150.HCBlack.png.exe 2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml 2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jre-1.8\bin\j2pcsc.dll.exe 2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\WXPNSE.DLL 2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\VisualElements\PrivateBrowsing_70.png 2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.scale-100_contrast-black.png.exe 2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsSplashScreen.scale-100.png.exe 2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\webviewBoot.min.js 2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\en-us\CT_ROOTS.XML 2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\7-Zip\Lang\ast.txt 2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Grace-ul-oob.xrm-ms.exe 2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Packaging.dll.exe 2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-black_scale-125.png.exe 2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Assets\WideTile.scale-200_contrast-white.png.exe 2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\AppIcon.targetsize-256_contrast-white.png.exe 2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\OutlookMailBadge.scale-200.png 2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ko\PresentationUI.resources.dll.exe 2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\af_FEMININE.pak 2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-profile-l1-1-0.dll 2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ppd.xrm-ms.exe 2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libtransform_plugin.dll.exe 2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-64.png 2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\PesterState.ps1.exe 2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\wordmui.msi.16.en-us.boot.tree.dat 2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.AddIn.Contract.dll.exe 2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\ExchangeSmallTile.scale-200.png 2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ul-oob.xrm-ms.exe 2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\TellMePowerPoint.nrr.exe 2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL120.XML.exe 2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Windows Photo Viewer\it-IT\PhotoAcq.dll.mui 2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-100_8wekyb3d8bbwe\resources.pri.exe 2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\resources.pri.exe 2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-60_altform-unplated.png 2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\glib-lite.dll 2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_output\libdirectdraw_plugin.dll.exe 2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\ScreenSketch.exe 2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-36_altform-unplated_contrast-black.png.exe 2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\C2R64.dll.exe 2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\200.png.exe 2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-100_8wekyb3d8bbwe\resources.pri.exe 2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\contrast-white\MixedRealityPortalAppList.targetsize-80_altform-unplated_contrast-white.png.exe 2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleSmallTile.scale-200.png.exe 2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-48.png 2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Xml.XPath.XDocument.dll.exe 2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\Spacer\5px.png.exe 2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\40.jpg.exe 2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-black\LargeTile.scale-100.png 2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxAccountsSmallTile.scale-100.png 2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-processthreads-l1-1-0.dll.exe 2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-conio-l1-1-0.dll 2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\api-ms-win-crt-filesystem-l1-1-0.dll 2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-64_altform-unplated.png.exe 2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll.exe 2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libsharpen_plugin.dll 2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\AppxManifest.xml 2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\8041_48x48x32.png 2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarWideTile.scale-100.png.exe 2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\PresentationCore.resources.dll 2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\GameBar_LargeTile.scale-125.png 2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GamesXboxHubMedTile.scale-200_contrast-white.png.exe 2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\AppIcon.scale-150.png 2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Voices\beeps\common.lua.exe 2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-01-16_5bfb26826a5c55748fac0426a96c3147_coinminer_glassworm_poet-rat_sliver_snatch.exe"1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
PID:372
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7-zip.dll.exe
- Size 19.6MB
- SHA256 2619778b6d2bedd28fe6386f7f7aef124a444c7fe815e30cf0f755f42329071e
- MD5 b313a7c2d1998fba8a7011658873fecf
- SHA1 134a2a11664fee83f8ed5ab11b306639016ba863
- SHA512 dfc59d5b00eec981b29a2cfffee1092c0b17f8ab01df00c7c842eb4c887fc4892b8c0d98d4f2c78ae671926d96b100ff4a88277d5d2f4e5f2eddd4cf1983dc59
- SSDEEP 393216:DAkLRCR3R7R6RLRKRRRcR2R7RQRER2RuRMR6RhRFR1RA:ES
- TLSH T10327CF31B7E849AAC2BFD379D06206261EF0B827622BEB4F5E8054FD1D53BD09915363
- MD5 SHA1 SHA512 SSDEEP TLSH