Analysis
- max time kernel
150s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/08/2026, 09:19
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-23_6e6634f608a69529a9752bb8e0e97abf_coinminer_glassworm_poet-rat_sliver_snatch.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-23_6e6634f608a69529a9752bb8e0e97abf_coinminer_glassworm_poet-rat_sliver_snatch.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target 2026-08-23_6e6634f608a69529a9752bb8e0e97abf_coinminer_glassworm_poet-rat_sliver_snatch.exe
- Size 26.2MB
- Sample260824-lan9zsem3t
- SHA256 4845288f691de9d8279034f49f5b560e208582db0b41725ef82f7aaed5d86aef
- MD5 6e6634f608a69529a9752bb8e0e97abf
- SHA1 0bb0afff5b4b04d3917f0fe6617da24e60c050e5
- SHA512 2f9de7f2da52de43f880373c69c72331c403a3abf473057d21dc5831a2cf82f4ec8380c89b7845e15d6bccf5cf702416d384c4707e24eedbe37382094b444f04
- SSDEEP 393216:v/HNRBR/RORXRURXR/RXRjRqRXR/R/RORXRLRyRHR/R/RyR/RHRxRXRRR/R+R/R8:3t
- TLSH T10E57BF2177E84AAAC2EFD37AE07206261FF1F527622BEB4F5D8444FA1D437909911363
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables referencing virtualization MAC addresses 1 IoCs
resource yara_rule behavioral2/files/0x000200000001b2d6-4.dat INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb - Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-08-23_6e6634f608a69529a9752bb8e0e97abf_coinminer_glassworm_poet-rat_sliver_snatch.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre-1.8\lib\ext\sunjce_provider.jar.exe 2026-08-23_6e6634f608a69529a9752bb8e0e97abf_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-ul-phn.xrm-ms 2026-08-23_6e6634f608a69529a9752bb8e0e97abf_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-ul-oob.xrm-ms.exe 2026-08-23_6e6634f608a69529a9752bb8e0e97abf_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\TellMeOutlookAddr.nrr 2026-08-23_6e6634f608a69529a9752bb8e0e97abf_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\INTLDATE.DLL 2026-08-23_6e6634f608a69529a9752bb8e0e97abf_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\VOLTAGE.WAV.exe 2026-08-23_6e6634f608a69529a9752bb8e0e97abf_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\ONLNTCOMLIB.DLL.exe 2026-08-23_6e6634f608a69529a9752bb8e0e97abf_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_de.properties.exe 2026-08-23_6e6634f608a69529a9752bb8e0e97abf_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jre-1.8\lib\jfr.jar.exe 2026-08-23_6e6634f608a69529a9752bb8e0e97abf_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-pl.xrm-ms.exe 2026-08-23_6e6634f608a69529a9752bb8e0e97abf_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_COL.HXC 2026-08-23_6e6634f608a69529a9752bb8e0e97abf_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE.exe 2026-08-23_6e6634f608a69529a9752bb8e0e97abf_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-ppd.xrm-ms 2026-08-23_6e6634f608a69529a9752bb8e0e97abf_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientCapabilities.json.exe 2026-08-23_6e6634f608a69529a9752bb8e0e97abf_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019DemoR_BypassTrial180-ppd.xrm-ms 2026-08-23_6e6634f608a69529a9752bb8e0e97abf_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-pl.xrm-ms 2026-08-23_6e6634f608a69529a9752bb8e0e97abf_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ul-phn.xrm-ms.exe 2026-08-23_6e6634f608a69529a9752bb8e0e97abf_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\MAPISHELLR.DLL 2026-08-23_6e6634f608a69529a9752bb8e0e97abf_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\SCDRESPL.ICO.exe 2026-08-23_6e6634f608a69529a9752bb8e0e97abf_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Core.NetFX35.dll.exe 2026-08-23_6e6634f608a69529a9752bb8e0e97abf_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OART.DLL 2026-08-23_6e6634f608a69529a9752bb8e0e97abf_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\cpprestsdk.dll 2026-08-23_6e6634f608a69529a9752bb8e0e97abf_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ppd.xrm-ms 2026-08-23_6e6634f608a69529a9752bb8e0e97abf_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ul-phn.xrm-ms 2026-08-23_6e6634f608a69529a9752bb8e0e97abf_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ul.xrm-ms 2026-08-23_6e6634f608a69529a9752bb8e0e97abf_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-80.png 2026-08-23_6e6634f608a69529a9752bb8e0e97abf_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\7-Zip\Lang\ne.txt 2026-08-23_6e6634f608a69529a9752bb8e0e97abf_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\System\ja-JP\wab32res.dll.mui 2026-08-23_6e6634f608a69529a9752bb8e0e97abf_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\TrebuchetMs.xml.exe 2026-08-23_6e6634f608a69529a9752bb8e0e97abf_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\OFFRHD.DLL.exe 2026-08-23_6e6634f608a69529a9752bb8e0e97abf_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ink\kk-KZ\tipresx.dll.mui.exe 2026-08-23_6e6634f608a69529a9752bb8e0e97abf_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-ul-phn.xrm-ms.exe 2026-08-23_6e6634f608a69529a9752bb8e0e97abf_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Trial-ul-oob.xrm-ms.exe 2026-08-23_6e6634f608a69529a9752bb8e0e97abf_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OSFSHARED.DLL 2026-08-23_6e6634f608a69529a9752bb8e0e97abf_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MEDIA\BREEZE.WAV 2026-08-23_6e6634f608a69529a9752bb8e0e97abf_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml.exe 2026-08-23_6e6634f608a69529a9752bb8e0e97abf_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-debug-l1-1-0.dll 2026-08-23_6e6634f608a69529a9752bb8e0e97abf_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-pl.xrm-ms.exe 2026-08-23_6e6634f608a69529a9752bb8e0e97abf_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\System\ado\msader15.dll.exe 2026-08-23_6e6634f608a69529a9752bb8e0e97abf_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.osmuxmui.msi.16.en-us.xml 2026-08-23_6e6634f608a69529a9752bb8e0e97abf_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-pl.xrm-ms.exe 2026-08-23_6e6634f608a69529a9752bb8e0e97abf_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-ppd.xrm-ms.exe 2026-08-23_6e6634f608a69529a9752bb8e0e97abf_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\ZeroByteFile.exe 2026-08-23_6e6634f608a69529a9752bb8e0e97abf_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-140.png 2026-08-23_6e6634f608a69529a9752bb8e0e97abf_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\STSLIST.CHM 2026-08-23_6e6634f608a69529a9752bb8e0e97abf_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-140.png 2026-08-23_6e6634f608a69529a9752bb8e0e97abf_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\7-Zip\7-zip32.dll 2026-08-23_6e6634f608a69529a9752bb8e0e97abf_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-100.png.exe 2026-08-23_6e6634f608a69529a9752bb8e0e97abf_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-pl.xrm-ms.exe 2026-08-23_6e6634f608a69529a9752bb8e0e97abf_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\SCHDRESP.CFG 2026-08-23_6e6634f608a69529a9752bb8e0e97abf_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\7-Zip\Lang\ar.txt 2026-08-23_6e6634f608a69529a9752bb8e0e97abf_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man.exe 2026-08-23_6e6634f608a69529a9752bb8e0e97abf_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Grace-ul-oob.xrm-ms 2026-08-23_6e6634f608a69529a9752bb8e0e97abf_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-ppd.xrm-ms.exe 2026-08-23_6e6634f608a69529a9752bb8e0e97abf_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONMAIN.DLL 2026-08-23_6e6634f608a69529a9752bb8e0e97abf_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\7-Zip\Lang\nl.txt 2026-08-23_6e6634f608a69529a9752bb8e0e97abf_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-timezone-l1-1-0.dll.exe 2026-08-23_6e6634f608a69529a9752bb8e0e97abf_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-pl.xrm-ms.exe 2026-08-23_6e6634f608a69529a9752bb8e0e97abf_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\TellMeOutlookMeetingReqSend.nrr 2026-08-23_6e6634f608a69529a9752bb8e0e97abf_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_f7\FA000000007.exe 2026-08-23_6e6634f608a69529a9752bb8e0e97abf_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\pt-BR\msipc.dll.mui 2026-08-23_6e6634f608a69529a9752bb8e0e97abf_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll 2026-08-23_6e6634f608a69529a9752bb8e0e97abf_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Client\vccorlib140.dll.exe 2026-08-23_6e6634f608a69529a9752bb8e0e97abf_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-ppd.xrm-ms 2026-08-23_6e6634f608a69529a9752bb8e0e97abf_coinminer_glassworm_poet-rat_sliver_snatch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-23_6e6634f608a69529a9752bb8e0e97abf_coinminer_glassworm_poet-rat_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-23_6e6634f608a69529a9752bb8e0e97abf_coinminer_glassworm_poet-rat_sliver_snatch.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:5524
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7-zip32.dll
- Size 26.8MB
- SHA256 12412a402d8625f0900ce812596acc88c04953f7f5fd1326643c796d47bbd7ae
- MD5 62e5fdf5a015427b5072bafea4c9f3a7
- SHA1 8e25b824491b9aaa27a6627d0e4daa68651036e1
- SHA512 2a7a2dd5ff7fbdcf16738146bd492309d95d9b11c4b365378fff4ff6f5723ae934cf8b368790fd8282cea8f1f8fec1106646b3e0590bd7984b082c5e841d3291
- SSDEEP 393216:v/HNRBR/RORXRURXR/RXRjRqRXR/R/RORXRLRyRHR/R/RyR/RHRxRXRRR/R+R/Ru:39
- TLSH T13457BF2177E84AAAC2EFD37AE07206261FF1F527622BEB4F5D8444FA1D437909911363
- MD5 SHA1 SHA512 SSDEEP TLSH