Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
22/08/2026, 04:24
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-08-22_4c2feeeb577ca49c9cfc5ec23387bbd6_cobalt-strike_coinminer_glassworm_luca-stealer_poet-rat.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 2026-08-22_4c2feeeb577ca49c9cfc5ec23387bbd6_cobalt-strike_coinminer_glassworm_luca-stealer_poet-rat.exe
- Size 7.9MB
- Sample260822-e1jc4a1brb
- SHA256 75115343913b5ba9883649f55a8d3d48b61c02b74c054bbccc8a4ebe17d7bb99
- MD5 4c2feeeb577ca49c9cfc5ec23387bbd6
- SHA1 06174b3af44559eaa64908c83a2b8208257b01a2
- SHA512 7843a8a2d42419a88973347d0f62a5f90dc6ee5173c48bc8e02ef84e33df0180b7c969d28e2408dd229e52a10edfa3385c3567d9144bf9aa09d32cfab2715f72
- SSDEEP 98304:P5zo0RdjyKB1KtSKJ/68lCT2QgTdg1GvkYSIg3zb:P5zHbj1B1yPJ6MCT2LTZvnS
- TLSH T102863B16F8A304E9C5BEE1308A569332BA7138A583307BD71F989A755B75FD07A3E310
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
resource yara_rule behavioral1/memory/708-2-0x0000000000150000-0x000000000098D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore - Detects executables referencing many IR and analysis tools 1 IoCs
resource yara_rule behavioral1/memory/708-2-0x0000000000150000-0x000000000098D000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Looks up external IP address via web service 1 TTPs 7 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 9 checkip.amazonaws.com 10 ident.me 12 icanhazip.com 4 icanhazip.com 5 myexternalip.com 7 whatismyip.akamai.com 8 myip.dnsomatic.com - Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1536 cmd.exe 1800 cmd.exe - Detects videocard installed 1 TTPs 2 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 3636 WMIC.exe 2892 WMIC.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 708 2026-08-22_4c2feeeb577ca49c9cfc5ec23387bbd6_cobalt-strike_coinminer_glassworm_luca-stealer_poet-rat.exe 708 2026-08-22_4c2feeeb577ca49c9cfc5ec23387bbd6_cobalt-strike_coinminer_glassworm_luca-stealer_poet-rat.exe 708 2026-08-22_4c2feeeb577ca49c9cfc5ec23387bbd6_cobalt-strike_coinminer_glassworm_luca-stealer_poet-rat.exe 708 2026-08-22_4c2feeeb577ca49c9cfc5ec23387bbd6_cobalt-strike_coinminer_glassworm_luca-stealer_poet-rat.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 708 2026-08-22_4c2feeeb577ca49c9cfc5ec23387bbd6_cobalt-strike_coinminer_glassworm_luca-stealer_poet-rat.exe Token: SeIncreaseQuotaPrivilege 2892 WMIC.exe Token: SeSecurityPrivilege 2892 WMIC.exe Token: SeTakeOwnershipPrivilege 2892 WMIC.exe Token: SeLoadDriverPrivilege 2892 WMIC.exe Token: SeSystemProfilePrivilege 2892 WMIC.exe Token: SeSystemtimePrivilege 2892 WMIC.exe Token: SeProfSingleProcessPrivilege 2892 WMIC.exe Token: SeIncBasePriorityPrivilege 2892 WMIC.exe Token: SeCreatePagefilePrivilege 2892 WMIC.exe Token: SeBackupPrivilege 2892 WMIC.exe Token: SeRestorePrivilege 2892 WMIC.exe Token: SeShutdownPrivilege 2892 WMIC.exe Token: SeDebugPrivilege 2892 WMIC.exe Token: SeSystemEnvironmentPrivilege 2892 WMIC.exe Token: SeRemoteShutdownPrivilege 2892 WMIC.exe Token: SeUndockPrivilege 2892 WMIC.exe Token: SeManageVolumePrivilege 2892 WMIC.exe Token: 33 2892 WMIC.exe Token: 34 2892 WMIC.exe Token: 35 2892 WMIC.exe Token: 36 2892 WMIC.exe Token: SeIncreaseQuotaPrivilege 2892 WMIC.exe Token: SeSecurityPrivilege 2892 WMIC.exe Token: SeTakeOwnershipPrivilege 2892 WMIC.exe Token: SeLoadDriverPrivilege 2892 WMIC.exe Token: SeSystemProfilePrivilege 2892 WMIC.exe Token: SeSystemtimePrivilege 2892 WMIC.exe Token: SeProfSingleProcessPrivilege 2892 WMIC.exe Token: SeIncBasePriorityPrivilege 2892 WMIC.exe Token: SeCreatePagefilePrivilege 2892 WMIC.exe Token: SeBackupPrivilege 2892 WMIC.exe Token: SeRestorePrivilege 2892 WMIC.exe Token: SeShutdownPrivilege 2892 WMIC.exe Token: SeDebugPrivilege 2892 WMIC.exe Token: SeSystemEnvironmentPrivilege 2892 WMIC.exe Token: SeRemoteShutdownPrivilege 2892 WMIC.exe Token: SeUndockPrivilege 2892 WMIC.exe Token: SeManageVolumePrivilege 2892 WMIC.exe Token: 33 2892 WMIC.exe Token: 34 2892 WMIC.exe Token: 35 2892 WMIC.exe Token: 36 2892 WMIC.exe Token: SeIncreaseQuotaPrivilege 3636 WMIC.exe Token: SeSecurityPrivilege 3636 WMIC.exe Token: SeTakeOwnershipPrivilege 3636 WMIC.exe Token: SeLoadDriverPrivilege 3636 WMIC.exe Token: SeSystemProfilePrivilege 3636 WMIC.exe Token: SeSystemtimePrivilege 3636 WMIC.exe Token: SeProfSingleProcessPrivilege 3636 WMIC.exe Token: SeIncBasePriorityPrivilege 3636 WMIC.exe Token: SeCreatePagefilePrivilege 3636 WMIC.exe Token: SeBackupPrivilege 3636 WMIC.exe Token: SeRestorePrivilege 3636 WMIC.exe Token: SeShutdownPrivilege 3636 WMIC.exe Token: SeDebugPrivilege 3636 WMIC.exe Token: SeSystemEnvironmentPrivilege 3636 WMIC.exe Token: SeRemoteShutdownPrivilege 3636 WMIC.exe Token: SeUndockPrivilege 3636 WMIC.exe Token: SeManageVolumePrivilege 3636 WMIC.exe Token: 33 3636 WMIC.exe Token: 34 3636 WMIC.exe Token: 35 3636 WMIC.exe Token: 36 3636 WMIC.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 708 wrote to memory of 1536 708 2026-08-22_4c2feeeb577ca49c9cfc5ec23387bbd6_cobalt-strike_coinminer_glassworm_luca-stealer_poet-rat.exe 85 PID 1536 wrote to memory of 2892 1536 cmd.exe 87 PID 708 wrote to memory of 1800 708 2026-08-22_4c2feeeb577ca49c9cfc5ec23387bbd6_cobalt-strike_coinminer_glassworm_luca-stealer_poet-rat.exe 89 PID 1800 wrote to memory of 3636 1800 cmd.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-22_4c2feeeb577ca49c9cfc5ec23387bbd6_cobalt-strike_coinminer_glassworm_luca-stealer_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-22_4c2feeeb577ca49c9cfc5ec23387bbd6_cobalt-strike_coinminer_glassworm_luca-stealer_poet-rat.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:708 -
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
- Suspicious use of AdjustPrivilegeToken
PID:2892
-
-
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
- Suspicious use of AdjustPrivilegeToken
PID:3636
-
-