Analysis
- max time kernel
148s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/08/2026, 04:10
Behavioral task
behavioral1
Sample
2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
- Size 9.9MB
- Sample260823-erf7daej21
- SHA256 60e347768afffd8344a4ea0a788fdc2c65f62af86d0a60a61183fc2b0a60f9c8
- MD5 9ab34e43173906afb4e116a61e8c2ad9
- SHA1 5af551cab96c237cc54b71002dd90a14d4507345
- SHA512 fff70765e1c632d83dfd8bc221bfc1dc1b3429a2cdbc0f33a5a67788ed491de3a438c149319fcacd8afd7e596039830cf650ba1ff523324704c5068b52eed19d
- SSDEEP 196608:I+D5q1SGs2yRwtkpqShR2hRShRnhR2hRXhRB:DAkLRiR2RhRiRRRB
- TLSH T16AB6AF32F9E505EAC2BFE274C06252217EB17C675332FB875F8055A91D63BD0A92E312
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
gravityrat
C2
-
https://ent34ndx3cz8k.x.pipedream.net
-
.b17da333ec194ec4b767.d.requestbin.net
Signatures
- Family: GravityRAT
GravityRAT is a cross-platform malware an Android, macOS and Windows based RAT first seen in 2015.
- Detects executables referencing virtualization MAC addresses 1 IoCs
resource yara_rule behavioral2/files/0x000500000001b871-4.dat INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\N = "c:\\Windows\\System32\\N.exe" 2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ScnBijpO = "c:\\Windows\\System32\\ScnBijpO.exe" 2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ar = "c:\\Windows\\System32\\ar.exe" 2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe - Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created \??\c:\Windows\System32\ar.exe 2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created \??\c:\Windows\System32\N.exe 2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created \??\c:\Windows\System32\ScnBijpO.exe 2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\Welcome.html 2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe.exe 2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\mip_telemetry.dll.exe 2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libty_plugin.dll 2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\services_discovery\libupnp_plugin.dll 2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe.exe 2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Violet II.xml.exe 2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\PPSLAX.DLL.exe 2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SyncFusion.Tools.Base.dll.exe 2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-private-l1-1-0.dll 2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\or_IN\LC_MESSAGES\vlc.mo 2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\lua\playlist\appletrailers.luac.exe 2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\rockbox_fm_presets.luac 2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\jpeg.md 2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jfxmedia.dll 2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe.exe 2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\WordNaiveBayesCommandRanker.txt.exe 2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINDATAPROVIDER.DLL.exe 2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONDIRECTX.DLL.exe 2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libtheora_plugin.dll 2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-tw.dll 2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui.exe 2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019DemoR_BypassTrial180-ul-oob.xrm-ms 2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-100.png 2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-math-l1-1-0.dll 2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\DUBAI-LIGHT.TTF 2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Microsoft.Office.Interop.Excel.dll.exe 2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Windows Defender\it-IT\OfflineScannerShell.exe.mui 2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\System\ado\adovbs.inc.exe 2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\System\ado\msado20.tlb.exe 2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Internet Explorer\fr-FR\iexplore.exe.mui 2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\thaidict.md 2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-ul-oob.xrm-ms.exe 2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\FAXEXT.ECF 2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUECALM\BLUECALM.INF.exe 2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STRTEDGE\STRTEDGE.ELM 2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-ppd.xrm-ms 2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-80.png.exe 2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\ms\msipc.dll.mui 2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-string-l1-1-0.dll.exe 2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\MSB1CACH.LEX 2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vreg\proof.fr-fr.msi.16.fr-fr.vreg.dat 2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Linq.Resources.dll 2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libdvbsub_plugin.dll.exe 2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\7-Zip\7-zip.chm.exe 2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-pl.xrm-ms.exe 2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN001.XML.exe 2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationProvider.dll 2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipTsf.dll.mui 2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\joni.md.exe 2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ul-phn.xrm-ms.exe 2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\rsod\wordmui.msi.16.en-us.boot.tree.dat.exe 2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\anevia_streams.luac 2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sk-sk.dll.exe 2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-libraryloader-l1-1-0.dll 2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-ul-oob.xrm-ms 2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHEVI.DLL.exe 2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE.MANIFEST.exe 2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\vlc.mo 2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\id_NEUTER.pak.exe 2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-ppd.xrm-ms 2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] 2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\en\SpreadsheetIQ.ExcelServices.Resources.dll.exe 2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-convert-l1-1-0.dll 2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-22_9ab34e43173906afb4e116a61e8c2ad9_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe"1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
PID:904
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7-zip.dll.exe
- Size 10.6MB
- SHA256 842a5d2f02e59a9913c23d0ae9a4d96500638f298e02b6fb8b56e99f6104b190
- MD5 6817d1b0eb1abdb7a502a59b6c081429
- SHA1 951c0b57b543f20aa1ca4727ab42ebda5666f612
- SHA512 84b98865a371a3f254c2e804b47486648eda918e5f292fb8abfd21ac60c479f03a9cb665b411cf0713cf5bb0143e88f554f7386bbe74cf27aa8e136ea3ef3159
- SSDEEP 196608:I+D5q1SGs2yRwtkpqShR2hRShRnhR2hRXhRChR/:DAkLRiR2RhRiRRRmR/
- TLSH T15FB6BF32F6E405EAC2BFE274C06252217EB178675326FB875F8055E91D63BD0AD2E312
- MD5 SHA1 SHA512 SSDEEP TLSH