Overview

overview

10

Static

static

10

2026-08-21...ch.exe

windows10-2004-x64

10

2026-08-21...ch.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    145s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    21/08/2026, 11:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-21_50e7de821d562ae4c2f50336fec9cf59_coinminer_glassworm_poet-rat_sliver_snatch.exe
  • Size 4.6MB
  • Sample260821-m5rt2asydz
  • SHA256 fd154f061c5be67a7c999042cb3df0b506248eb4b0a38a997178aaf3b4a9b9fc
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
credential_accessdefense_evasiondiscoveryexecutionimpactpersistenceprivilege_escalationransomwarespywarestealer

Malware Config

Extracted

Path

  • C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\HOW TO RESTORE YOUR FILES.TXT

Ransom Note
  • Hello! All your files are encrypted and only I can decrypt them. Contact me: [email protected] Write me if you want to return your files - I can do it very quickly! The header of letter must contain extension of encrypted files. I'm always reply within 24 hours. If not - check spam folder, resend your letter or try send letter from another email service (like protonmail.com). Attention! Do not rename or edit encrypted files: you may have permanent data loss. To prove that I can recover your files, I am ready to decrypt any three files (less than 1Mb) for free (except databases, Excel and backups) HURRY UP! ! ! ! If you do not email me in the next 48 hours then your data may be lost permanently ! ! !

Signatures

  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Renames multiple (9615) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in Program Files directory 64 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Executes a command shell one-liner 1 TTPs 4 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-21_50e7de821d562ae4c2f50336fec9cf59_coinminer_glassworm_poet-rat_sliver_snatch.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-21_50e7de821d562ae4c2f50336fec9cf59_coinminer_glassworm_poet-rat_sliver_snatch.exe"
    1⤵
    • Creates a file in the Startup directory
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:3684
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\fmdefh.bat
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:944
      • C:\Windows\system32\sc.exe
        SC QUERY
        3⤵
        • Launches sc.exe
        PID:3660
      • C:\Windows\system32\findstr.exe
        FINDSTR SERVICE_NAME
        3⤵
          PID:4484
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\raqlgjhonnfsfekuccgs.bat
        2⤵
        • Executes a command shell one-liner
        PID:2696
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gorjbcqqcmp.bat
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4164
        • C:\Windows\system32\vssadmin.exe
          vssadmin delete shadows /all /quiet
          3⤵
          • Interacts with shadow copies
          PID:2972
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\cfnuuckkwppldtn.bat
        2⤵
        • Executes a command shell one-liner
        PID:1928
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3592

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Command and Scripting Interpreter

          1
          T1059

          Windows Command Shell

          1
          T1059.003

          Windows Management Instrumentation

          1
          T1047

          Persistence

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Privilege Escalation

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Defense Evasion

          Direct Volume Access

          1
          T1006

          Indicator Removal

          2
          T1070

          File Deletion

          2
          T1070.004

          Credential Access

          Credentials from Password Stores

          2
          T1555

          Credentials from Web Browsers

          1
          T1555.003

          Windows Credential Manager

          1
          T1555.004

          Unsecured Credentials

          1
          T1552

          Credentials In Files

          1
          T1552.001

          Discovery

          Browser Information Discovery

          1
          T1217

          Lateral Movement

          Collection

          Data from Local System

          1
          T1005

          Command and Control

          Exfiltration

          Impact

          Inhibit System Recovery

          2
          T1490

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          af.pak
          • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Locales\af.pak
          • Size 1018KB
          • SHA256 c43e4db18d98f6c04df05180f29c126a3cc967aec2fefb0bb32f1c8b0e8c4b5e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          as.pak
          • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Locales\as.pak
          • Size 2.1MB
          • SHA256 f9bc3d1eaea64884bc52ea56244da158741c0572b4f41a4368050222f3f6bcb5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          bg.pak.sdkkxbh
          • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Locales\bg.pak.sdkkxbh
          • Size 1.7MB
          • SHA256 3294d9555aa5eaf3049830e1e57c58ae65573bba874c1f9fbb25aa676d27edb3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ca-Es-VALENCIA.pak
          • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Locales\ca-Es-VALENCIA.pak
          • Size 1.1MB
          • SHA256 3f050fdcc6a158db5251084ad464a3f00d8c367f63b96918b1440bc324acd004
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cs.pak
          • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Locales\cs.pak
          • Size 1.1MB
          • SHA256 69f40a5784825e0a479f9e5970adaa67c091ea7d5fe74d93175bb7ce22f58196
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          de.pak
          • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Locales\de.pak
          • Size 1.1MB
          • SHA256 7c94c5f02a205d1e18bdc5b153d6db6101fe3aaa86def7ad881846a4fe0ed1a5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          en-GB.pak
          • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Locales\en-GB.pak
          • Size 928KB
          • SHA256 e5be66506743fe7661b4c440242e7982677a46b7b813923f4d52d4c69253cd96
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          en-US.pak
          • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Locales\en-US.pak
          • Size 912KB
          • SHA256 1e65971002ae7c19d41c666f6aa0e83b43520d6295be915d359f8bb11087c2e0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          es.pak
          • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Locales\es.pak
          • Size 1.1MB
          • SHA256 06a816af1059a21475681b7840ff131775e5cb14dda375c0158dad4ed408f7ee
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          fr-CA.pak.sdkkxbh
          • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Locales\fr-CA.pak.sdkkxbh
          • Size 1.2MB
          • SHA256 bee202e8ed0fcfe71cbb4177daab1e6882903789bed6a292c524b1a966a3fb1d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          gl.pak
          • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Locales\gl.pak
          • Size 1.1MB
          • SHA256 e8777b676e0f8c4c97da5c3f291c806ed7e6117e051e65d5f42780d0a5b75cd3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          hu.pak
          • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Locales\hu.pak
          • Size 1.1MB
          • SHA256 6701a9d2f2f8495949c545bf5796b450ebafb81036db56ae55eb823f6c1bc10f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          it.pak
          • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Locales\it.pak
          • Size 1.1MB
          • SHA256 a4aaf798eaa5526a2d7e82b6a498c91cf14d589e7cb28b6fd1d8ce97913d5cd0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ja.pak
          • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Locales\ja.pak
          • Size 1.3MB
          • SHA256 6a6fb261fc074b0f3d8a7a29ebeac7137968d71895a573c39ee7db81b39013a0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ms.pak
          • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Locales\ms.pak
          • Size 1.0MB
          • SHA256 73c5d357bb6525f418bd6dc0d2fcdf3b8ec33340b2098ddb58229621b4422d7a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          nb.pak
          • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Locales\nb.pak
          • Size 991KB
          • SHA256 eaee9c877bb1cae6cf79cce03425c8ee3892d310e0c87dfd70c084d1a23f6e3d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pl.pak
          • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Locales\pl.pak
          • Size 1.1MB
          • SHA256 e5780d8406e237a201da39f56449d1e8750c9c4902914b7b142b1157fcb5a80f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ru.pak.sdkkxbh
          • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Locales\ru.pak.sdkkxbh
          • Size 1.7MB
          • SHA256 bc32414f1e25bfe24da9cb6fe1b754dabd95fffe9891947c3c79c2b3745e2e6a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          sr-Cyrl-BA.pak.sdkkxbh
          • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Locales\sr-Cyrl-BA.pak.sdkkxbh
          • Size 1.6MB
          • SHA256 801d4242a179cd52731b062757aff96be188558f2dd25154611169085c1becf5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          sv.pak
          • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Locales\sv.pak
          • Size 1016KB
          • SHA256 c12deac516766364a328549754090509bf6d1bcee9338dd365f523b6722065b4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tt.pak
          • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Locales\tt.pak
          • Size 1.7MB
          • SHA256 caf91ea856654ca741a77caabe5c3dc5dff9d0321d7ea32437b2643760b48baf
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ug.pak
          • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Locales\ug.pak
          • Size 1.6MB
          • SHA256 fb0069728fa4e927f67cd30cc1469dd281d4e035ec1cfe516c14cca84cc4730d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          uk.pak
          • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Locales\uk.pak
          • Size 1.7MB
          • SHA256 56ee3abf8a57383e2ac42025e813f91efd5b283cb42807337689179d5fc8f127
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          zh-CN.pak
          • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Locales\zh-CN.pak
          • Size 873KB
          • SHA256 b558b4c7bf2da439bf56867d2bfe67c09f33cf8639b0512985ecc3ea7b3c4c40
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Advertising
          • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Trust Protection Lists\Mu\Advertising
          • Size 25KB
          • SHA256 e98f09dd327c5d7d77e98bc9c0118bb0b63d8631af8f9eac19d055c5da2e023a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          LICENSE
          • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Trust Protection Lists\Mu\LICENSE
          • Size 34KB
          • SHA256 92e7131604a2ad3d30e933e3707233cc2f0973d6ce9bcdd68e4c46726630b82b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Social
          • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Trust Protection Lists\Mu\Social
          • Size 906B
          • SHA256 88a902e691b68241ba1758b296cbe7cc1bc5c3f85304a66b34432de8781be3f7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Cryptomining
          • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Trust Protection Lists\Sigma\Cryptomining
          • Size 571B
          • SHA256 e9bdd370bccfe45d2578f12e775476fc1fb56259f3693429bb80355a26ba9222
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          LICENSE
          • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Trust Protection Lists\Sigma\LICENSE
          • Size 608B
          • SHA256 e14864a3b014bd6ad02bc4913efb836afaea74a8761207475171d6674b9527ae
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Logo.png.sdkkxbh
          • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\VisualElements\Logo.png.sdkkxbh
          • Size 32KB
          • SHA256 a0748354678e4a3b2c9a2d8a84ec794446d554e06b435f2985b122e370d63727
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          LogoCanary.png
          • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\VisualElements\LogoCanary.png
          • Size 30KB
          • SHA256 c84b8e3df055d89bcf37dec557c2fe294ac84112b773e40e567800a8bcb847d6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SmallLogo.png.sdkkxbh
          • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\VisualElements\SmallLogo.png.sdkkxbh
          • Size 16KB
          • SHA256 f812a9a4569136485e4d59b61526c3405257548f6b360557860683e46fdae15e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          widevinecdm.dll.sig
          • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig
          • Size 1KB
          • SHA256 5c0472288fbdc0d397a54e4a97052c1b6f9615db70a2a581bd4d673dcb5bc9f6
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          manifest.json
          • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\WidevineCdm\manifest.json
          • Size 1KB
          • SHA256 b1bfbe2f4a74fcd60bf81d3898773d2c46da11e6399677f0e8998a60d0ca8813
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          stable.identity_helper.exe.manifest
          • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_proxy\stable.identity_helper.exe.manifest
          • Size 1KB
          • SHA256 ec74fc6253c45d9e9043323f3d22a1f9025f164abdd9289c89366a366e2f0bf1
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          identity_helper.Sparse.Internal.msix.sdkkxbh
          • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_proxy\win10\identity_helper.Sparse.Internal.msix.sdkkxbh
          • Size 57KB
          • SHA256 28e033228e0e8cea77db98c1b1e5f768b74ac746e1863db256415351a1d43805
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          identity_helper.Sparse.Dev.msix
          • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_proxy\win11\identity_helper.Sparse.Dev.msix
          • Size 53KB
          • SHA256 f0e0c18deac360d9b4532b5239756764d0224ae5d9d4d0fb107af811041b3642
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          identity_helper.Sparse.Stable.msix
          • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_proxy\win11\identity_helper.Sparse.Stable.msix
          • Size 57KB
          • SHA256 52aff1868c1d9ab011b59aace7875de96b934a288f0e6a57c86eec0fd3796c06
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedge_100_percent.pak
          • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_100_percent.pak
          • Size 1.6MB
          • SHA256 fa3b6f77d851b8252f23ed6faa49c8ac48d6c2612b361e3e4452562887aafdc0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgewebview2.exe.sig.sdkkxbh
          • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe.sig.sdkkxbh
          • Size 1KB
          • SHA256 9005639ddaaa9e7dd9de304fd4b856428557fbabf5aa69b0a45ab7a0e03d8395
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          HOW TO RESTORE YOUR FILES.TXT
          • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\HOW TO RESTORE YOUR FILES.TXT
          • Size 735B
          • SHA256 22b0fefbada36e946dabf5da01d68ae922cee7326ec7b6162dd4e3b88ebc70ee
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          fmdefh.bat
          • Path C:\Users\Admin\AppData\Local\Temp\fmdefh.bat
          • Size 43B
          • SHA256 1fbdb97893d09d59575c3ef95df3c929fe6b6ddf1b273283e4efadf94cdc802d
          • MD5 SHA1 SHA512
          Submit Download

          gorjbcqqcmp.bat
          • Path C:\Users\Admin\AppData\Local\Temp\gorjbcqqcmp.bat
          • Size 47B
          • SHA256 0965cb8ee38adedd9ba06bdad9220a35890c2df0e4c78d0559cd6da653bf740f
          • MD5 SHA1 SHA512
          Submit Download