Analysis
- max time kernel
150s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/08/2026, 04:24
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-08-22_4c2feeeb577ca49c9cfc5ec23387bbd6_cobalt-strike_coinminer_glassworm_luca-stealer_poet-rat.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 2026-08-22_4c2feeeb577ca49c9cfc5ec23387bbd6_cobalt-strike_coinminer_glassworm_luca-stealer_poet-rat.exe
- Size 7.9MB
- Sample260822-e1jc4a1brb
- SHA256 75115343913b5ba9883649f55a8d3d48b61c02b74c054bbccc8a4ebe17d7bb99
- MD5 4c2feeeb577ca49c9cfc5ec23387bbd6
- SHA1 06174b3af44559eaa64908c83a2b8208257b01a2
- SHA512 7843a8a2d42419a88973347d0f62a5f90dc6ee5173c48bc8e02ef84e33df0180b7c969d28e2408dd229e52a10edfa3385c3567d9144bf9aa09d32cfab2715f72
- SSDEEP 98304:P5zo0RdjyKB1KtSKJ/68lCT2QgTdg1GvkYSIg3zb:P5zHbj1B1yPJ6MCT2LTZvnS
- TLSH T102863B16F8A304E9C5BEE1308A569332BA7138A583307BD71F989A755B75FD07A3E310
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
resource yara_rule behavioral2/memory/5020-2-0x0000000000620000-0x0000000000E5D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore - Detects executables referencing many IR and analysis tools 1 IoCs
resource yara_rule behavioral2/memory/5020-2-0x0000000000620000-0x0000000000E5D000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Looks up external IP address via web service 1 TTPs 7 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 7 whatismyip.akamai.com 8 myexternalip.com 9 myip.dnsomatic.com 14 icanhazip.com 4 ident.me 5 checkip.amazonaws.com 6 icanhazip.com - Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2356 cmd.exe 4900 cmd.exe - Detects videocard installed 1 TTPs 2 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 2712 WMIC.exe 2748 WMIC.exe - Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 5020 2026-08-22_4c2feeeb577ca49c9cfc5ec23387bbd6_cobalt-strike_coinminer_glassworm_luca-stealer_poet-rat.exe 5020 2026-08-22_4c2feeeb577ca49c9cfc5ec23387bbd6_cobalt-strike_coinminer_glassworm_luca-stealer_poet-rat.exe 5020 2026-08-22_4c2feeeb577ca49c9cfc5ec23387bbd6_cobalt-strike_coinminer_glassworm_luca-stealer_poet-rat.exe 5020 2026-08-22_4c2feeeb577ca49c9cfc5ec23387bbd6_cobalt-strike_coinminer_glassworm_luca-stealer_poet-rat.exe 2712 WMIC.exe 2712 WMIC.exe 2712 WMIC.exe 2712 WMIC.exe 2748 WMIC.exe 2748 WMIC.exe 2748 WMIC.exe 2748 WMIC.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5020 2026-08-22_4c2feeeb577ca49c9cfc5ec23387bbd6_cobalt-strike_coinminer_glassworm_luca-stealer_poet-rat.exe Token: SeIncreaseQuotaPrivilege 2712 WMIC.exe Token: SeSecurityPrivilege 2712 WMIC.exe Token: SeTakeOwnershipPrivilege 2712 WMIC.exe Token: SeLoadDriverPrivilege 2712 WMIC.exe Token: SeSystemProfilePrivilege 2712 WMIC.exe Token: SeSystemtimePrivilege 2712 WMIC.exe Token: SeProfSingleProcessPrivilege 2712 WMIC.exe Token: SeIncBasePriorityPrivilege 2712 WMIC.exe Token: SeCreatePagefilePrivilege 2712 WMIC.exe Token: SeBackupPrivilege 2712 WMIC.exe Token: SeRestorePrivilege 2712 WMIC.exe Token: SeShutdownPrivilege 2712 WMIC.exe Token: SeDebugPrivilege 2712 WMIC.exe Token: SeSystemEnvironmentPrivilege 2712 WMIC.exe Token: SeRemoteShutdownPrivilege 2712 WMIC.exe Token: SeUndockPrivilege 2712 WMIC.exe Token: SeManageVolumePrivilege 2712 WMIC.exe Token: 33 2712 WMIC.exe Token: 34 2712 WMIC.exe Token: 35 2712 WMIC.exe Token: 36 2712 WMIC.exe Token: SeIncreaseQuotaPrivilege 2712 WMIC.exe Token: SeSecurityPrivilege 2712 WMIC.exe Token: SeTakeOwnershipPrivilege 2712 WMIC.exe Token: SeLoadDriverPrivilege 2712 WMIC.exe Token: SeSystemProfilePrivilege 2712 WMIC.exe Token: SeSystemtimePrivilege 2712 WMIC.exe Token: SeProfSingleProcessPrivilege 2712 WMIC.exe Token: SeIncBasePriorityPrivilege 2712 WMIC.exe Token: SeCreatePagefilePrivilege 2712 WMIC.exe Token: SeBackupPrivilege 2712 WMIC.exe Token: SeRestorePrivilege 2712 WMIC.exe Token: SeShutdownPrivilege 2712 WMIC.exe Token: SeDebugPrivilege 2712 WMIC.exe Token: SeSystemEnvironmentPrivilege 2712 WMIC.exe Token: SeRemoteShutdownPrivilege 2712 WMIC.exe Token: SeUndockPrivilege 2712 WMIC.exe Token: SeManageVolumePrivilege 2712 WMIC.exe Token: 33 2712 WMIC.exe Token: 34 2712 WMIC.exe Token: 35 2712 WMIC.exe Token: 36 2712 WMIC.exe Token: SeIncreaseQuotaPrivilege 2748 WMIC.exe Token: SeSecurityPrivilege 2748 WMIC.exe Token: SeTakeOwnershipPrivilege 2748 WMIC.exe Token: SeLoadDriverPrivilege 2748 WMIC.exe Token: SeSystemProfilePrivilege 2748 WMIC.exe Token: SeSystemtimePrivilege 2748 WMIC.exe Token: SeProfSingleProcessPrivilege 2748 WMIC.exe Token: SeIncBasePriorityPrivilege 2748 WMIC.exe Token: SeCreatePagefilePrivilege 2748 WMIC.exe Token: SeBackupPrivilege 2748 WMIC.exe Token: SeRestorePrivilege 2748 WMIC.exe Token: SeShutdownPrivilege 2748 WMIC.exe Token: SeDebugPrivilege 2748 WMIC.exe Token: SeSystemEnvironmentPrivilege 2748 WMIC.exe Token: SeRemoteShutdownPrivilege 2748 WMIC.exe Token: SeUndockPrivilege 2748 WMIC.exe Token: SeManageVolumePrivilege 2748 WMIC.exe Token: 33 2748 WMIC.exe Token: 34 2748 WMIC.exe Token: 35 2748 WMIC.exe Token: 36 2748 WMIC.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 5020 wrote to memory of 2356 5020 2026-08-22_4c2feeeb577ca49c9cfc5ec23387bbd6_cobalt-strike_coinminer_glassworm_luca-stealer_poet-rat.exe 89 PID 2356 wrote to memory of 2712 2356 cmd.exe 91 PID 5020 wrote to memory of 4900 5020 2026-08-22_4c2feeeb577ca49c9cfc5ec23387bbd6_cobalt-strike_coinminer_glassworm_luca-stealer_poet-rat.exe 93 PID 4900 wrote to memory of 2748 4900 cmd.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-22_4c2feeeb577ca49c9cfc5ec23387bbd6_cobalt-strike_coinminer_glassworm_luca-stealer_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-22_4c2feeeb577ca49c9cfc5ec23387bbd6_cobalt-strike_coinminer_glassworm_luca-stealer_poet-rat.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2712
-
-
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2748
-
-