Analysis
- max time kernel
149s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
22/08/2026, 03:58
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
2026-08-22_7f54e082b9191df80cb06b6f2b25142d_cobalt-strike_coinminer_glassworm_luca-stealer_poet-rat.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target 2026-08-22_7f54e082b9191df80cb06b6f2b25142d_cobalt-strike_coinminer_glassworm_luca-stealer_poet-rat.exe
- Size 7.9MB
- Sample260822-ejvpss1bkf
- SHA256 039d81682757cca9d6674dd04164cf7d6d2457bfa80e3ead96f7ab7d808f0692
- MD5 7f54e082b9191df80cb06b6f2b25142d
- SHA1 b35b72403beb79bd2462b76a91721170f53fb336
- SHA512 4fb7a5d262d9094462080a115e4e8a86a4d14036644a3accb318cf74479385daa2349452025ab2e593bc7cdcffab161943d866cf8a6dc713d8150c8c134a3496
- SSDEEP 98304:fVAhF6+DdnBuIiyBkfGye4gRAfdNpRlMlLbIgN:fVAzlDJBubcmG94gRodnMhb
- TLSH T182864C16F8A304F9C5BEE1348A969322BA71386483307BD71FD89A755A75FD07A3E310
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
resource yara_rule behavioral1/memory/3152-2-0x00000000004F0000-0x0000000000D2D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore - Detects executables referencing many IR and analysis tools 1 IoCs
resource yara_rule behavioral1/memory/3152-2-0x00000000004F0000-0x0000000000D2D000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools - Detects files referencing the transfer.sh file sharing website 1 IoCs
resource yara_rule behavioral1/memory/3152-2-0x00000000004F0000-0x0000000000D2D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_TransferSh_URL - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Looks up external IP address via web service 1 TTPs 6 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 10 ident.me 4 icanhazip.com 5 myexternalip.com 7 whatismyip.akamai.com 8 myip.dnsomatic.com 9 checkip.amazonaws.com - Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 812 cmd.exe 1056 cmd.exe - Detects videocard installed 1 TTPs 2 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 2404 WMIC.exe 1444 WMIC.exe - GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
description flow ioc HTTP User-Agent header 19 Go-http-client/1.1 - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3152 2026-08-22_7f54e082b9191df80cb06b6f2b25142d_cobalt-strike_coinminer_glassworm_luca-stealer_poet-rat.exe 3152 2026-08-22_7f54e082b9191df80cb06b6f2b25142d_cobalt-strike_coinminer_glassworm_luca-stealer_poet-rat.exe 3152 2026-08-22_7f54e082b9191df80cb06b6f2b25142d_cobalt-strike_coinminer_glassworm_luca-stealer_poet-rat.exe 3152 2026-08-22_7f54e082b9191df80cb06b6f2b25142d_cobalt-strike_coinminer_glassworm_luca-stealer_poet-rat.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3152 2026-08-22_7f54e082b9191df80cb06b6f2b25142d_cobalt-strike_coinminer_glassworm_luca-stealer_poet-rat.exe Token: SeIncreaseQuotaPrivilege 2404 WMIC.exe Token: SeSecurityPrivilege 2404 WMIC.exe Token: SeTakeOwnershipPrivilege 2404 WMIC.exe Token: SeLoadDriverPrivilege 2404 WMIC.exe Token: SeSystemProfilePrivilege 2404 WMIC.exe Token: SeSystemtimePrivilege 2404 WMIC.exe Token: SeProfSingleProcessPrivilege 2404 WMIC.exe Token: SeIncBasePriorityPrivilege 2404 WMIC.exe Token: SeCreatePagefilePrivilege 2404 WMIC.exe Token: SeBackupPrivilege 2404 WMIC.exe Token: SeRestorePrivilege 2404 WMIC.exe Token: SeShutdownPrivilege 2404 WMIC.exe Token: SeDebugPrivilege 2404 WMIC.exe Token: SeSystemEnvironmentPrivilege 2404 WMIC.exe Token: SeRemoteShutdownPrivilege 2404 WMIC.exe Token: SeUndockPrivilege 2404 WMIC.exe Token: SeManageVolumePrivilege 2404 WMIC.exe Token: 33 2404 WMIC.exe Token: 34 2404 WMIC.exe Token: 35 2404 WMIC.exe Token: 36 2404 WMIC.exe Token: SeIncreaseQuotaPrivilege 2404 WMIC.exe Token: SeSecurityPrivilege 2404 WMIC.exe Token: SeTakeOwnershipPrivilege 2404 WMIC.exe Token: SeLoadDriverPrivilege 2404 WMIC.exe Token: SeSystemProfilePrivilege 2404 WMIC.exe Token: SeSystemtimePrivilege 2404 WMIC.exe Token: SeProfSingleProcessPrivilege 2404 WMIC.exe Token: SeIncBasePriorityPrivilege 2404 WMIC.exe Token: SeCreatePagefilePrivilege 2404 WMIC.exe Token: SeBackupPrivilege 2404 WMIC.exe Token: SeRestorePrivilege 2404 WMIC.exe Token: SeShutdownPrivilege 2404 WMIC.exe Token: SeDebugPrivilege 2404 WMIC.exe Token: SeSystemEnvironmentPrivilege 2404 WMIC.exe Token: SeRemoteShutdownPrivilege 2404 WMIC.exe Token: SeUndockPrivilege 2404 WMIC.exe Token: SeManageVolumePrivilege 2404 WMIC.exe Token: 33 2404 WMIC.exe Token: 34 2404 WMIC.exe Token: 35 2404 WMIC.exe Token: 36 2404 WMIC.exe Token: SeIncreaseQuotaPrivilege 1444 WMIC.exe Token: SeSecurityPrivilege 1444 WMIC.exe Token: SeTakeOwnershipPrivilege 1444 WMIC.exe Token: SeLoadDriverPrivilege 1444 WMIC.exe Token: SeSystemProfilePrivilege 1444 WMIC.exe Token: SeSystemtimePrivilege 1444 WMIC.exe Token: SeProfSingleProcessPrivilege 1444 WMIC.exe Token: SeIncBasePriorityPrivilege 1444 WMIC.exe Token: SeCreatePagefilePrivilege 1444 WMIC.exe Token: SeBackupPrivilege 1444 WMIC.exe Token: SeRestorePrivilege 1444 WMIC.exe Token: SeShutdownPrivilege 1444 WMIC.exe Token: SeDebugPrivilege 1444 WMIC.exe Token: SeSystemEnvironmentPrivilege 1444 WMIC.exe Token: SeRemoteShutdownPrivilege 1444 WMIC.exe Token: SeUndockPrivilege 1444 WMIC.exe Token: SeManageVolumePrivilege 1444 WMIC.exe Token: 33 1444 WMIC.exe Token: 34 1444 WMIC.exe Token: 35 1444 WMIC.exe Token: 36 1444 WMIC.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3152 wrote to memory of 812 3152 2026-08-22_7f54e082b9191df80cb06b6f2b25142d_cobalt-strike_coinminer_glassworm_luca-stealer_poet-rat.exe 88 PID 812 wrote to memory of 2404 812 cmd.exe 90 PID 3152 wrote to memory of 1056 3152 2026-08-22_7f54e082b9191df80cb06b6f2b25142d_cobalt-strike_coinminer_glassworm_luca-stealer_poet-rat.exe 92 PID 1056 wrote to memory of 1444 1056 cmd.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-22_7f54e082b9191df80cb06b6f2b25142d_cobalt-strike_coinminer_glassworm_luca-stealer_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-22_7f54e082b9191df80cb06b6f2b25142d_cobalt-strike_coinminer_glassworm_luca-stealer_poet-rat.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:812 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
- Suspicious use of AdjustPrivilegeToken
PID:2404
-
-
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
- Suspicious use of AdjustPrivilegeToken
PID:1444
-
-