Analysis
- max time kernel
148s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/08/2026, 04:19
Behavioral task
behavioral1
Sample
2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
- Size 10.0MB
- Sample260824-exy95ssgrc
- SHA256 b3e90821472c43566d9866d6c53f173948b640e6a886c32609296117b67512fa
- MD5 9916d285aad0fd00ffe71eaf1737eab8
- SHA1 5df51081b91c603e7ac759b2c815de64a5de059b
- SHA512 27f4811b3acc633168d8e6bcb2b02dfb19f9b3988870dbb68ec992722dfa915186bb3ba2b4ae2bbfc304d9e38dd548101cf3485d1785eeffc894e7c248705779
- SSDEEP 196608:I+D5q1SGs2yRwtkpqShRBhR3hRbhRQhRMhRMC:DAkLRLRxRtRMRwRx
- TLSH T110B6BF32F9E505EAC2BFE274C06242217EB178675336FB875F8055E91D63BD0A92E312
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
gravityrat
C2
-
https://ent34ndx3cz8k.x.pipedream.net
-
.b17da333ec194ec4b767.d.requestbin.net
Signatures
- Family: GravityRAT
GravityRAT is a cross-platform malware an Android, macOS and Windows based RAT first seen in 2015.
- Detects executables referencing virtualization MAC addresses 1 IoCs
resource yara_rule behavioral2/files/0x000300000001b7f9-4.dat INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rharJ = "c:\\Windows\\System32\\rharJ.exe" 2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AuOmBlSH = "c:\\Windows\\System32\\AuOmBlSH.exe" 2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ul = "c:\\Windows\\System32\\ul.exe" 2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe - Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created \??\c:\Windows\System32\rharJ.exe 2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created \??\c:\Windows\System32\AuOmBlSH.exe 2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created \??\c:\Windows\System32\ul.exe 2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\Lang\fr.txt.exe 2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\System\en-US\wab32res.dll.mui 2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.exe 2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-ul-oob.xrm-ms 2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Office.PowerPivot.ExcelAddIn.tlb 2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\MS.JPG 2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\api-ms-win-crt-multibyte-l1-1-0.dll 2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\vcruntime140.dll 2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019DemoR_BypassTrial180-ul-oob.xrm-ms 2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_KMS_Client_AE-ppd.xrm-ms 2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\minimalist.dotx.exe 2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOADFPS.DLL.exe 2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\sbicuuc53_64.dll 2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Mozilla Firefox\xul.dll.sig 2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Xml.Linq.Resources.dll.exe 2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\hu_FEMININE.pak 2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md.exe 2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Word.Word.x-none.msi.16.x-none.xml 2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ul-phn.xrm-ms 2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OutlookAutoDiscover\YAHOO.NO.XML 2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL096.XML.exe 2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Mozilla Firefox\vcruntime140_1.dll 2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\Microsoft.Build.Utilities.v3.5.resources.dll 2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jdk-1.8\jvisualvm.txt 2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-ul-phn.xrm-ms 2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientPreview_eula.txt 2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-utility-l1-1-0.dll 2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\vlc.mo 2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\kab\LC_MESSAGES\vlc.mo 2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\vlc.mo.exe 2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_10_p010_plugin.dll.exe 2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msdaremr.dll.mui 2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt.exe 2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\splashscreen.dll.exe 2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Marquee.xml 2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red Orange.xml.exe 2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Grace-ul-oob.xrm-ms.exe 2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Grace-ppd.xrm-ms 2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\AdHocReportingExcelClient.dll.exe 2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\oledb32r.dll.mui 2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tipresx.dll.mui.exe 2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\US_export_policy.jar 2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ppd.xrm-ms 2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-pl.xrm-ms 2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\en-us\msipc.dll.mui.exe 2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-locale-l1-1-0.dll.exe 2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft.NET\ADOMD.NET\130\Microsoft.AnalysisServices.AdomdClient.dll.exe 2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.exe 2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\lua\http\view.html.exe 2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libsvcdsub_plugin.dll.exe 2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libmp4_plugin.dll 2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libgrain_plugin.dll.exe 2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Windows Defender\MpDefenderCoreService.exe.exe 2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Windows Defender\ThirdPartyNotices.txt 2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\MEIPreload\manifest.json 2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ul-phn.xrm-ms 2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\c2rpridslicensefiles_auto.xml 2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_K_COL.HXK 2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libvobsub_plugin.dll 2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_autodel_plugin.dll.exe 2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libpostproc_plugin.dll.exe 2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libwave_plugin.dll.exe 2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ink\Microsoft.Ink.Intelligence.TextInput.Implementation.dll 2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ink\tpcps.dll.exe 2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe"1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
PID:5332
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7-zip.dll.exe
- Size 10.8MB
- SHA256 eaaa4c660d48865a70ffbf9be251c710fa0db2069254b8fed1194376e04fbcdd
- MD5 a97fd344902c07e4602e76578af49986
- SHA1 9cde3d7f7ecef0b8644ba7aa0b39e455388ebec7
- SHA512 772c6cfc9f6e29d20ebaf910a875fbaac3e8f261b0daa91424e151db2ce09ede61aee349772ddac7e9137541b3898ba060567bdc36c88dad0411207eed1c5613
- SSDEEP 196608:I+D5q1SGs2yRwtkpqShRBhR3hRbhRQhRMhRMfhRU:DAkLRLRxRtRMRwR2RU
- TLSH T17DB6BF32F6E405EAC2BFE274C06252217EB178675326FB875F8055E91D63BD0AD2E312
- MD5 SHA1 SHA512 SSDEEP TLSH