Analysis
- max time kernel
150s - max time network
122s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/08/2026, 16:14
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-23_eef45781004fb75cda5cd93c27de67e3_coinminer_glassworm_poet-rat_sliver_snatch.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-23_eef45781004fb75cda5cd93c27de67e3_coinminer_glassworm_poet-rat_sliver_snatch.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target 2026-08-23_eef45781004fb75cda5cd93c27de67e3_coinminer_glassworm_poet-rat_sliver_snatch.exe
- Size 22.3MB
- Sample260823-tp24dshp3s
- SHA256 d893bf9ca4b6dec7a61897e3ede23b64b8afa94d26045c0511fd1733badaa796
- MD5 eef45781004fb75cda5cd93c27de67e3
- SHA1 204f379bf99d38a3e2f5a13c4f4fda7a5e1d2f89
- SHA512 1f4a2a29565515e5953a459b85ca3031168214ff5f129b32aea260a8fc6bf7aeea16b53cd4dac0b55f459e7e334c42569d2f1db6f5f5793a6b53da40d7c753e7
- SSDEEP 393216:v/HNRBR/RORXRURXR/RORXRRR/R/RgRWR/RRRWRxRFRXRXRXRuRXRZ:3+
- TLSH T15737BF31B7E84AAAC2EFD379D07206261FF1B427622BEB4F5D8444FA1D53B909911363
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables referencing virtualization MAC addresses 1 IoCs
resource yara_rule behavioral2/files/0x000200000001b2fc-4.dat INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb - Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-08-23_eef45781004fb75cda5cd93c27de67e3_coinminer_glassworm_poet-rat_sliver_snatch.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\w2k_lsa_auth.dll 2026-08-23_eef45781004fb75cda5cd93c27de67e3_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.vsto 2026-08-23_eef45781004fb75cda5cd93c27de67e3_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\th.pak.exe 2026-08-23_eef45781004fb75cda5cd93c27de67e3_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.officemui.msi.16.en-us.xml 2026-08-23_eef45781004fb75cda5cd93c27de67e3_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-08-23_eef45781004fb75cda5cd93c27de67e3_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\accessibility.properties 2026-08-23_eef45781004fb75cda5cd93c27de67e3_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\MSSPC.ECF 2026-08-23_eef45781004fb75cda5cd93c27de67e3_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f2\FA000000002 2026-08-23_eef45781004fb75cda5cd93c27de67e3_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll 2026-08-23_eef45781004fb75cda5cd93c27de67e3_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ink\mt-MT\tipresx.dll.mui 2026-08-23_eef45781004fb75cda5cd93c27de67e3_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OutlookLogo.contrast-black_scale-180.png.exe 2026-08-23_eef45781004fb75cda5cd93c27de67e3_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\System\Ole DB\it-IT\sqlxmlx.rll.mui 2026-08-23_eef45781004fb75cda5cd93c27de67e3_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Violet II.xml.exe 2026-08-23_eef45781004fb75cda5cd93c27de67e3_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-ul-phn.xrm-ms 2026-08-23_eef45781004fb75cda5cd93c27de67e3_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTest-pl.xrm-ms 2026-08-23_eef45781004fb75cda5cd93c27de67e3_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\msvcr120.dll 2026-08-23_eef45781004fb75cda5cd93c27de67e3_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\msdasqlr.dll.mui 2026-08-23_eef45781004fb75cda5cd93c27de67e3_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ink\id-ID\tipresx.dll.mui.exe 2026-08-23_eef45781004fb75cda5cd93c27de67e3_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\VisualElements\SmallLogoDev.png 2026-08-23_eef45781004fb75cda5cd93c27de67e3_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-ul-oob.xrm-ms 2026-08-23_eef45781004fb75cda5cd93c27de67e3_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms.exe 2026-08-23_eef45781004fb75cda5cd93c27de67e3_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_Subscription-ppd.xrm-ms 2026-08-23_eef45781004fb75cda5cd93c27de67e3_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-140.png.exe 2026-08-23_eef45781004fb75cda5cd93c27de67e3_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\jsse.jar 2026-08-23_eef45781004fb75cda5cd93c27de67e3_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jre-1.8\bin\plugin2\vcruntime140_1.dll.exe 2026-08-23_eef45781004fb75cda5cd93c27de67e3_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md 2026-08-23_eef45781004fb75cda5cd93c27de67e3_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-ul-oob.xrm-ms.exe 2026-08-23_eef45781004fb75cda5cd93c27de67e3_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CONVERT\1033\OLAPPTR.FAE 2026-08-23_eef45781004fb75cda5cd93c27de67e3_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\SCDRESPS.ICO.exe 2026-08-23_eef45781004fb75cda5cd93c27de67e3_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\FUNCRES.XLAM 2026-08-23_eef45781004fb75cda5cd93c27de67e3_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-stdio-l1-1-0.dll 2026-08-23_eef45781004fb75cda5cd93c27de67e3_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jpeg.dll 2026-08-23_eef45781004fb75cda5cd93c27de67e3_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\7-Zip\7z.sfx.exe 2026-08-23_eef45781004fb75cda5cd93c27de67e3_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.dll 2026-08-23_eef45781004fb75cda5cd93c27de67e3_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui 2026-08-23_eef45781004fb75cda5cd93c27de67e3_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml 2026-08-23_eef45781004fb75cda5cd93c27de67e3_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-ul-phn.xrm-ms 2026-08-23_eef45781004fb75cda5cd93c27de67e3_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OutlookAutoDiscover\YAHOO.CO.NZ.XML 2026-08-23_eef45781004fb75cda5cd93c27de67e3_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Internet Explorer\images\bing.ico 2026-08-23_eef45781004fb75cda5cd93c27de67e3_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\npt.dll 2026-08-23_eef45781004fb75cda5cd93c27de67e3_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jdk-1.8\lib\orb.idl.exe 2026-08-23_eef45781004fb75cda5cd93c27de67e3_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jre-1.8\lib\jfr.jar.exe 2026-08-23_eef45781004fb75cda5cd93c27de67e3_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Word.Word.x-none.msi.16.x-none.xml 2026-08-23_eef45781004fb75cda5cd93c27de67e3_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\sqmapi.dll 2026-08-23_eef45781004fb75cda5cd93c27de67e3_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\VOLTAGE.WAV.exe 2026-08-23_eef45781004fb75cda5cd93c27de67e3_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\System\fr-FR\wab32res.dll.mui.exe 2026-08-23_eef45781004fb75cda5cd93c27de67e3_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ENVELOPR.DLL 2026-08-23_eef45781004fb75cda5cd93c27de67e3_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\msinfo32.exe.mui.exe 2026-08-23_eef45781004fb75cda5cd93c27de67e3_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\he\msipc.dll.mui 2026-08-23_eef45781004fb75cda5cd93c27de67e3_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\OutlookAutoDiscover\YAHOO.IE.XML.exe 2026-08-23_eef45781004fb75cda5cd93c27de67e3_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL118.XML.exe 2026-08-23_eef45781004fb75cda5cd93c27de67e3_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OutlookLogoSmall.contrast-white_scale-80.png.exe 2026-08-23_eef45781004fb75cda5cd93c27de67e3_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE.exe 2026-08-23_eef45781004fb75cda5cd93c27de67e3_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\System\msadc\adcvbs.inc.exe 2026-08-23_eef45781004fb75cda5cd93c27de67e3_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Grace-ppd.xrm-ms.exe 2026-08-23_eef45781004fb75cda5cd93c27de67e3_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-180.png 2026-08-23_eef45781004fb75cda5cd93c27de67e3_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\classlist 2026-08-23_eef45781004fb75cda5cd93c27de67e3_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\LyncBasic_Eula.txt.exe 2026-08-23_eef45781004fb75cda5cd93c27de67e3_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME.txt.exe 2026-08-23_eef45781004fb75cda5cd93c27de67e3_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.exe 2026-08-23_eef45781004fb75cda5cd93c27de67e3_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-environment-l1-1-0.dll.exe 2026-08-23_eef45781004fb75cda5cd93c27de67e3_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordVL_KMS_Client-ul-oob.xrm-ms.exe 2026-08-23_eef45781004fb75cda5cd93c27de67e3_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l1-1-0.dll 2026-08-23_eef45781004fb75cda5cd93c27de67e3_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md.exe 2026-08-23_eef45781004fb75cda5cd93c27de67e3_coinminer_glassworm_poet-rat_sliver_snatch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-23_eef45781004fb75cda5cd93c27de67e3_coinminer_glassworm_poet-rat_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-23_eef45781004fb75cda5cd93c27de67e3_coinminer_glassworm_poet-rat_sliver_snatch.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:5544
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7-zip32.dll
- Size 22.9MB
- SHA256 78722403d92fc927f2851317cdd0fe6c59c496dd0e1f02c43ddfed7dba732d80
- MD5 050bee4afb7f430d64881d8a533bb375
- SHA1 0bc9f8128896e5b0978b86681adf82991e93eba6
- SHA512 b5a4a1b470786ba0560df8053c7a32333c6336d8e99330ddb49994109d2e12abd9ce19de776a7fd6c65ab32bd0a8cbe7ca4caebed534aeda3575271c43010aa1
- SSDEEP 393216:v/HNRBR/RORXRURXR/RORXRRR/R/RgRWR/RRRWRxRFRXRXRXRuRXRORc:3U
- TLSH T1D837BF31B7E84AAAC2EFD379D07206261FF1B427622BEB4F5D8444FA1D53B909911363
- MD5 SHA1 SHA512 SSDEEP TLSH