039d81682757cca9d6674dd04164cf7d6d2457bfa80e3ead96f7ab7d808f0692

Analysis

max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-22_7f54e082b9191df80cb06b6f2b25142d_cobalt-strike_coinminer_glassworm_luca-stealer_poet-rat.exe
Size 7.9MB
Sample260822-ejvpss1bkf
SHA256 039d81682757cca9d6674dd04164cf7d6d2457bfa80e3ead96f7ab7d808f0692
MD5 7f54e082b9191df80cb06b6f2b25142d
SHA1 b35b72403beb79bd2462b76a91721170f53fb336
SHA512 4fb7a5d262d9094462080a115e4e8a86a4d14036644a3accb318cf74479385daa2349452025ab2e593bc7cdcffab161943d866cf8a6dc713d8150c8c134a3496
SSDEEP 98304:fVAhF6+DdnBuIiyBkfGye4gRAfdNpRlMlLbIgN:fVAzlDJBubcmG94gRodnMhb
TLSH
T182864C16F8A304F9C5BEE1348A969322BA71386483307BD71FD89A755A75FD07A3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution spyware stealer trojan

Malware Config

Signatures

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral2/memory/912-56-0x0000000000E90000-0x00000000016CD000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
behavioral2/memory/912-56-0x0000000000E90000-0x00000000016CD000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools

Detects files referencing the transfer.sh file sharing website 1 IoCs

resource	yara_rule
behavioral2/memory/912-56-0x0000000000E90000-0x00000000016CD000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_TransferSh_URL

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 TTPs 8 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
3	icanhazip.com
4	checkip.amazonaws.com
5	ident.me
7	whatismyip.akamai.com
9	myip.dnsomatic.com
12	myexternalip.com
14	icanhazip.com
2	myexternalip.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2040	cmd.exe
2312	cmd.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c614000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2026-08-22_7f54e082b9191df80cb06b6f2b25142d_cobalt-strike_coinminer_glassworm_luca-stealer_poet-rat.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2026-08-22_7f54e082b9191df80cb06b6f2b25142d_cobalt-strike_coinminer_glassworm_luca-stealer_poet-rat.exe

Detects videocard installed 1 TTPs 2 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4704	WMIC.exe
5144	WMIC.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	20	Go-http-client/1.1

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	2026-08-22_7f54e082b9191df80cb06b6f2b25142d_cobalt-strike_coinminer_glassworm_luca-stealer_poet-rat.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
912	2026-08-22_7f54e082b9191df80cb06b6f2b25142d_cobalt-strike_coinminer_glassworm_luca-stealer_poet-rat.exe
912	2026-08-22_7f54e082b9191df80cb06b6f2b25142d_cobalt-strike_coinminer_glassworm_luca-stealer_poet-rat.exe
912	2026-08-22_7f54e082b9191df80cb06b6f2b25142d_cobalt-strike_coinminer_glassworm_luca-stealer_poet-rat.exe
912	2026-08-22_7f54e082b9191df80cb06b6f2b25142d_cobalt-strike_coinminer_glassworm_luca-stealer_poet-rat.exe
4704	WMIC.exe
4704	WMIC.exe
4704	WMIC.exe
4704	WMIC.exe
5144	WMIC.exe
5144	WMIC.exe
5144	WMIC.exe
5144	WMIC.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	912	2026-08-22_7f54e082b9191df80cb06b6f2b25142d_cobalt-strike_coinminer_glassworm_luca-stealer_poet-rat.exe
Token: SeIncreaseQuotaPrivilege	4704	WMIC.exe
Token: SeSecurityPrivilege	4704	WMIC.exe
Token: SeTakeOwnershipPrivilege	4704	WMIC.exe
Token: SeLoadDriverPrivilege	4704	WMIC.exe
Token: SeSystemProfilePrivilege	4704	WMIC.exe
Token: SeSystemtimePrivilege	4704	WMIC.exe
Token: SeProfSingleProcessPrivilege	4704	WMIC.exe
Token: SeIncBasePriorityPrivilege	4704	WMIC.exe
Token: SeCreatePagefilePrivilege	4704	WMIC.exe
Token: SeBackupPrivilege	4704	WMIC.exe
Token: SeRestorePrivilege	4704	WMIC.exe
Token: SeShutdownPrivilege	4704	WMIC.exe
Token: SeDebugPrivilege	4704	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4704	WMIC.exe
Token: SeRemoteShutdownPrivilege	4704	WMIC.exe
Token: SeUndockPrivilege	4704	WMIC.exe
Token: SeManageVolumePrivilege	4704	WMIC.exe
Token: 33	4704	WMIC.exe
Token: 34	4704	WMIC.exe
Token: 35	4704	WMIC.exe
Token: 36	4704	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4704	WMIC.exe
Token: SeSecurityPrivilege	4704	WMIC.exe
Token: SeTakeOwnershipPrivilege	4704	WMIC.exe
Token: SeLoadDriverPrivilege	4704	WMIC.exe
Token: SeSystemProfilePrivilege	4704	WMIC.exe
Token: SeSystemtimePrivilege	4704	WMIC.exe
Token: SeProfSingleProcessPrivilege	4704	WMIC.exe
Token: SeIncBasePriorityPrivilege	4704	WMIC.exe
Token: SeCreatePagefilePrivilege	4704	WMIC.exe
Token: SeBackupPrivilege	4704	WMIC.exe
Token: SeRestorePrivilege	4704	WMIC.exe
Token: SeShutdownPrivilege	4704	WMIC.exe
Token: SeDebugPrivilege	4704	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4704	WMIC.exe
Token: SeRemoteShutdownPrivilege	4704	WMIC.exe
Token: SeUndockPrivilege	4704	WMIC.exe
Token: SeManageVolumePrivilege	4704	WMIC.exe
Token: 33	4704	WMIC.exe
Token: 34	4704	WMIC.exe
Token: 35	4704	WMIC.exe
Token: 36	4704	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5144	WMIC.exe
Token: SeSecurityPrivilege	5144	WMIC.exe
Token: SeTakeOwnershipPrivilege	5144	WMIC.exe
Token: SeLoadDriverPrivilege	5144	WMIC.exe
Token: SeSystemProfilePrivilege	5144	WMIC.exe
Token: SeSystemtimePrivilege	5144	WMIC.exe
Token: SeProfSingleProcessPrivilege	5144	WMIC.exe
Token: SeIncBasePriorityPrivilege	5144	WMIC.exe
Token: SeCreatePagefilePrivilege	5144	WMIC.exe
Token: SeBackupPrivilege	5144	WMIC.exe
Token: SeRestorePrivilege	5144	WMIC.exe
Token: SeShutdownPrivilege	5144	WMIC.exe
Token: SeDebugPrivilege	5144	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5144	WMIC.exe
Token: SeRemoteShutdownPrivilege	5144	WMIC.exe
Token: SeUndockPrivilege	5144	WMIC.exe
Token: SeManageVolumePrivilege	5144	WMIC.exe
Token: 33	5144	WMIC.exe
Token: 34	5144	WMIC.exe
Token: 35	5144	WMIC.exe
Token: 36	5144	WMIC.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 912 wrote to memory of 2040	912	2026-08-22_7f54e082b9191df80cb06b6f2b25142d_cobalt-strike_coinminer_glassworm_luca-stealer_poet-rat.exe	90
PID 2040 wrote to memory of 4704	2040	cmd.exe	92
PID 912 wrote to memory of 2312	912	2026-08-22_7f54e082b9191df80cb06b6f2b25142d_cobalt-strike_coinminer_glassworm_luca-stealer_poet-rat.exe	93
PID 2312 wrote to memory of 5144	2312	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-08-22_7f54e082b9191df80cb06b6f2b25142d_cobalt-strike_coinminer_glassworm_luca-stealer_poet-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-22_7f54e082b9191df80cb06b6f2b25142d_cobalt-strike_coinminer_glassworm_luca-stealer_poet-rat.exe"
1⤵
- Modifies trusted root certificate store through registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:912
- C:\Windows\system32\cmd.exe
  cmd /C "wmic path win32_VideoController get name"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2040
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4704
- C:\Windows\system32\cmd.exe
  cmd /C "wmic path win32_VideoController get name"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2312
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

firefox_cookie.json

Path C:\Users\Admin\AppData\Local\Temp\111923611\firefox_cookie.json
Size 3B
SHA256 ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
MD5 8a80554c91d9fca8acb82f023de02f11
SHA1 5f36b2ea290645ee34d943220a14b54ee5ea5be5
SHA512 ca4b6defb8adcc010050bc8b1bb8f8092c4928b8a0fba32146abcfb256e4d91672f88ca2cdf6210e754e5b8ac5e23fb023806ccd749ac8b701f79a691f03c87a
MD5 SHA1 SHA512

Submit Download

microsoft_edge_download.json

Path C:\Users\Admin\AppData\Local\Temp\111923611\microsoft_edge_download.json
Size 5B
SHA256 38e0b9de817f645c4bec37c0d4a3e58baecccb040f5718dc069a72c7385a0bed
MD5 674441960ca1ba2de08ad4e50c9fde98
SHA1 d910b02871075d3156ec8675dfc95b7d5d640aa6
SHA512 f96f4e45908897091e943fce1cefceaf213ed5746b997b97187b3e6e989476132e2358b2c5af4ec8942b3c00d6f8d1273e539d1b2ea82aef6c0a92a312d88a6d
MD5 SHA1 SHA512

Submit Download

memory/912-56-0x0000000000E90000-0x00000000016CD000-memory.dmp

Download