Analysis
- max time kernel
149s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
23/08/2026, 18:58
Behavioral task
behavioral1
Sample
2026-08-23_da79bfc630fcf0c5dc891910250a6615_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2026-08-23_da79bfc630fcf0c5dc891910250a6615_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat.exe
- Size 7.8MB
- Sample260823-xmmsgayhph
- SHA256 1484992c4ec52ef40a39e713107ef92e72862144961c4ece4cc7f6f4017b7d35
- MD5 da79bfc630fcf0c5dc891910250a6615
- SHA1 19ec0554f3225b415473862a90f4d333202da5f5
- SHA512 497bdf67c0103fd1b92660069a6549f24180e64db01d80c649b7159fff61c03e58d4c39146e5c8e16ef2ee688fae0bb5fe93e98c6380bd3d1ab2a4e2b8b16ef6
- SSDEEP 196608:OFKcF3d1EdvMmdolW1uDZDtawHK0omuh:5cN16NoquDNT+mu
- TLSH T12A864C2BF4B304F9C67EE07082969772BE71745A43317B971F94DA691B12FE06A2E310
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 15 IoCs
resource yara_rule behavioral1/files/0x0002000000022b3b-5.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral1/memory/5504-405-0x0000000000400000-0x0000000000E83000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral1/memory/5504-1088-0x0000000000400000-0x0000000000E83000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral1/memory/5504-1785-0x0000000000400000-0x0000000000E83000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral1/memory/5504-2541-0x0000000000400000-0x0000000000E83000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral1/memory/5504-2911-0x0000000000400000-0x0000000000E83000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral1/memory/5504-3136-0x0000000000400000-0x0000000000E83000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral1/memory/5504-3169-0x0000000000400000-0x0000000000E83000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral1/memory/5504-3170-0x0000000000400000-0x0000000000E83000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral1/memory/5504-3171-0x0000000000400000-0x0000000000E83000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral1/memory/5504-3229-0x0000000000400000-0x0000000000E83000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral1/memory/5504-3231-0x0000000000400000-0x0000000000E83000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral1/memory/5504-3232-0x0000000000400000-0x0000000000E83000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral1/memory/5504-3233-0x0000000000400000-0x0000000000E83000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral1/memory/5504-3234-0x0000000000400000-0x0000000000E83000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - XMRig Miner payload 15 IoCs
resource yara_rule behavioral1/files/0x0002000000022b3b-5.dat xmrig behavioral1/memory/5504-405-0x0000000000400000-0x0000000000E83000-memory.dmp xmrig behavioral1/memory/5504-1088-0x0000000000400000-0x0000000000E83000-memory.dmp xmrig behavioral1/memory/5504-1785-0x0000000000400000-0x0000000000E83000-memory.dmp xmrig behavioral1/memory/5504-2541-0x0000000000400000-0x0000000000E83000-memory.dmp xmrig behavioral1/memory/5504-2911-0x0000000000400000-0x0000000000E83000-memory.dmp xmrig behavioral1/memory/5504-3136-0x0000000000400000-0x0000000000E83000-memory.dmp xmrig behavioral1/memory/5504-3169-0x0000000000400000-0x0000000000E83000-memory.dmp xmrig behavioral1/memory/5504-3170-0x0000000000400000-0x0000000000E83000-memory.dmp xmrig behavioral1/memory/5504-3171-0x0000000000400000-0x0000000000E83000-memory.dmp xmrig behavioral1/memory/5504-3229-0x0000000000400000-0x0000000000E83000-memory.dmp xmrig behavioral1/memory/5504-3231-0x0000000000400000-0x0000000000E83000-memory.dmp xmrig behavioral1/memory/5504-3232-0x0000000000400000-0x0000000000E83000-memory.dmp xmrig behavioral1/memory/5504-3233-0x0000000000400000-0x0000000000E83000-memory.dmp xmrig behavioral1/memory/5504-3234-0x0000000000400000-0x0000000000E83000-memory.dmp xmrig - Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-08-23_da79bfc630fcf0c5dc891910250a6615_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat.exe File created C:\Program Files\desktop.ini 2026-08-23_da79bfc630fcf0c5dc891910250a6615_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Excel.Extensions.dll 2026-08-23_da79bfc630fcf0c5dc891910250a6615_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RADIAL\RADIAL.INF 2026-08-23_da79bfc630fcf0c5dc891910250a6615_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\Microsoft.Build.Utilities.v3.5.resources.dll 2026-08-23_da79bfc630fcf0c5dc891910250a6615_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Win10\cardflipped.dat 2026-08-23_da79bfc630fcf0c5dc891910250a6615_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\powered-by-foursquare.png 2026-08-23_da79bfc630fcf0c5dc891910250a6615_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat.exe File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\MedTile.scale-200.png 2026-08-23_da79bfc630fcf0c5dc891910250a6615_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-black_targetsize-30.png 2026-08-23_da79bfc630fcf0c5dc891910250a6615_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms 2026-08-23_da79bfc630fcf0c5dc891910250a6615_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-pl.xrm-ms 2026-08-23_da79bfc630fcf0c5dc891910250a6615_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat.exe File created C:\Program Files\WindowsApps\Microsoft.NET.Native.Framework.1.7_1.7.25531.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml 2026-08-23_da79bfc630fcf0c5dc891910250a6615_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-20_altform-fullcolor.png 2026-08-23_da79bfc630fcf0c5dc891910250a6615_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\contrast-white\MedTile.scale-100.png 2026-08-23_da79bfc630fcf0c5dc891910250a6615_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-64.png 2026-08-23_da79bfc630fcf0c5dc891910250a6615_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OutlookAutoDiscover\SNET.NET.XML 2026-08-23_da79bfc630fcf0c5dc891910250a6615_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sw\LC_MESSAGES\vlc.mo 2026-08-23_da79bfc630fcf0c5dc891910250a6615_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Voices\beeps\uncommon.lua 2026-08-23_da79bfc630fcf0c5dc891910250a6615_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\te_NEUTER.pak 2026-08-23_da79bfc630fcf0c5dc891910250a6615_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ul-phn.xrm-ms 2026-08-23_da79bfc630fcf0c5dc891910250a6615_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\pt-BR\msipc.dll.mui 2026-08-23_da79bfc630fcf0c5dc891910250a6615_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SLATE\SLATE.ELM 2026-08-23_da79bfc630fcf0c5dc891910250a6615_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\lt-LT\View3d\3DViewerProductDescription-universal.xml 2026-08-23_da79bfc630fcf0c5dc891910250a6615_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNotebookSmallTile.scale-125.png 2026-08-23_da79bfc630fcf0c5dc891910250a6615_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat.exe File created C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00.UWPDesktop_14.0.27629.0_x64__8wekyb3d8bbwe\vcruntime140.dll 2026-08-23_da79bfc630fcf0c5dc891910250a6615_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderLogoExtensions.targetsize-40.png 2026-08-23_da79bfc630fcf0c5dc891910250a6615_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl\Assets\OfflinePages\Scripts\Me\MeControl\offline\offlineStrings.js 2026-08-23_da79bfc630fcf0c5dc891910250a6615_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\ArchiveToastQuickAction.scale-80.png 2026-08-23_da79bfc630fcf0c5dc891910250a6615_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Advanced-Light.scale-300.png 2026-08-23_da79bfc630fcf0c5dc891910250a6615_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\OUTLOOK_F_COL.HXK 2026-08-23_da79bfc630fcf0c5dc891910250a6615_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat.exe File created C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\LargeTile.scale-150.png 2026-08-23_da79bfc630fcf0c5dc891910250a6615_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml 2026-08-23_da79bfc630fcf0c5dc891910250a6615_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat.exe File created C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\Autogen\JSByteCodeCache_64 2026-08-23_da79bfc630fcf0c5dc891910250a6615_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarBadge.scale-200.png 2026-08-23_da79bfc630fcf0c5dc891910250a6615_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\api-ms-win-core-xstate-l2-1-0.dll 2026-08-23_da79bfc630fcf0c5dc891910250a6615_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\1033\msointl30.dll 2026-08-23_da79bfc630fcf0c5dc891910250a6615_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\es-ES\View3d\3DViewerProductDescription-universal.xml 2026-08-23_da79bfc630fcf0c5dc891910250a6615_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\System.Reflection.DispatchProxy.dll 2026-08-23_da79bfc630fcf0c5dc891910250a6615_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat.exe File created C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\S-1-5-21-3053180483-1881419501-3594244048-1000-MergedResources-0.pri 2026-08-23_da79bfc630fcf0c5dc891910250a6615_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\LinkedInboxSmallTile.scale-150.png 2026-08-23_da79bfc630fcf0c5dc891910250a6615_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial-ppd.xrm-ms 2026-08-23_da79bfc630fcf0c5dc891910250a6615_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat.exe File created C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll 2026-08-23_da79bfc630fcf0c5dc891910250a6615_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\SystemX86\mfc140.dll 2026-08-23_da79bfc630fcf0c5dc891910250a6615_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat.exe File created C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleSmallTile.scale-200.png 2026-08-23_da79bfc630fcf0c5dc891910250a6615_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-ul-phn.xrm-ms 2026-08-23_da79bfc630fcf0c5dc891910250a6615_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\S-1-5-21-3053180483-1881419501-3594244048-1000-MergedResources-0.pri 2026-08-23_da79bfc630fcf0c5dc891910250a6615_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-black\MedTile.scale-100.png 2026-08-23_da79bfc630fcf0c5dc891910250a6615_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\javafx\webkit.md 2026-08-23_da79bfc630fcf0c5dc891910250a6615_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\librawaud_plugin.dll 2026-08-23_da79bfc630fcf0c5dc891910250a6615_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml 2026-08-23_da79bfc630fcf0c5dc891910250a6615_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\MyOffice.BackgroundTasks.dll 2026-08-23_da79bfc630fcf0c5dc891910250a6615_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat.exe File created C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\BadgeLogo.scale-200.png 2026-08-23_da79bfc630fcf0c5dc891910250a6615_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Voices\beeps\beeps\beep 2026-08-23_da79bfc630fcf0c5dc891910250a6615_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailWideTile.scale-150.png 2026-08-23_da79bfc630fcf0c5dc891910250a6615_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\accessibilitychecker\main.js 2026-08-23_da79bfc630fcf0c5dc891910250a6615_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat.exe File created C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-64_altform-lightunplated.png 2026-08-23_da79bfc630fcf0c5dc891910250a6615_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\browse_window.html 2026-08-23_da79bfc630fcf0c5dc891910250a6615_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat.exe File created C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\AppxSignature.p7x 2026-08-23_da79bfc630fcf0c5dc891910250a6615_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat.exe File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-72_altform-unplated_contrast-white.png 2026-08-23_da79bfc630fcf0c5dc891910250a6615_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat.exe File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SmallTile.scale-400_contrast-black.png 2026-08-23_da79bfc630fcf0c5dc891910250a6615_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-64_altform-unplated.png 2026-08-23_da79bfc630fcf0c5dc891910250a6615_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.Xml.dll 2026-08-23_da79bfc630fcf0c5dc891910250a6615_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\cldr.md 2026-08-23_da79bfc630fcf0c5dc891910250a6615_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat.exe File created C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Assets\TinyTile.scale-200_contrast-black.png 2026-08-23_da79bfc630fcf0c5dc891910250a6615_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\iacom2im.dll 2026-08-23_da79bfc630fcf0c5dc891910250a6615_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat.exe File created C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\contrast-white\MixedRealityPortalAppList.targetsize-40_altform-unplated_contrast-white.png 2026-08-23_da79bfc630fcf0c5dc891910250a6615_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeLockMemoryPrivilege 5504 2026-08-23_da79bfc630fcf0c5dc891910250a6615_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat.exe Token: SeLockMemoryPrivilege 5504 2026-08-23_da79bfc630fcf0c5dc891910250a6615_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-23_da79bfc630fcf0c5dc891910250a6615_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-23_da79bfc630fcf0c5dc891910250a6615_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:5504
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7-zip32.dll
- Size 8.0MB
- SHA256 e8287dc4ed817e7b3d016acbf6f9cb319fde7032efb948cf82cd6a4fb207a4c7
- MD5 9ddd20f9c69ffa9e0c40a4bfdb83b696
- SHA1 a710f7d37e05fbff6a9603f5dc414e114470cd7b
- SHA512 46e12fdc145ec36d7fe9af6d77a9905ff65d68bfeea9fa414b895a6316bef97c9ca9b0f7509355ca3f5e5aa0e06544354315eb7e053f1bd62bde8006b8fcf74b
- SSDEEP 196608:OFKcF3d1EdvMmdolW1uDZDtawHK0omuhY:5cN16NoquDNT+mu+
- TLSH T1D4864C2BF4B304F9C67EE07082969772BE71745A43317B971F94DA691B12FE06A2E310
- MD5 SHA1 SHA512 SSDEEP TLSH