Analysis
- max time kernel
150s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/08/2026, 15:23
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-23_26829f44203fb3b4e46e64e229211bda_coinminer_glassworm_poet-rat_sliver_snatch.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-23_26829f44203fb3b4e46e64e229211bda_coinminer_glassworm_poet-rat_sliver_snatch.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target 2026-08-23_26829f44203fb3b4e46e64e229211bda_coinminer_glassworm_poet-rat_sliver_snatch.exe
- Size 25.0MB
- Sample260824-ssvm2szemd
- SHA256 232e5465c6141990af4ce6524f77dc7088fcdd1f335783d3b3e67fadf1c931a6
- MD5 26829f44203fb3b4e46e64e229211bda
- SHA1 5cb00d6454c113e9402fce247d586018fac53ab0
- SHA512 d6853f700aba0ead1b9722034db672191010564b008593650287504f4de919ff38619765bb13b72f6d8fa82c2e235cbfc7aa2f99a86e833813699fec9c232d3a
- SSDEEP 393216:v/HNRBR/RORXRURXR/ROR8R/RXRNRaR/R/RmR/RXRyRmRXRORxRHRuRXRRRXRa:3W
- TLSH T17347BF2177E84AAAC2EFD37AE07206161FF1F427622BEB4F5D8444FA1D53B909911363
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables referencing virtualization MAC addresses 1 IoCs
resource yara_rule behavioral2/files/0x000200000001b323-4.dat INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb - Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-08-23_26829f44203fb3b4e46e64e229211bda_coinminer_glassworm_poet-rat_sliver_snatch.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcDemoR_BypassTrial365-ppd.xrm-ms.exe 2026-08-23_26829f44203fb3b4e46e64e229211bda_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-pl.xrm-ms 2026-08-23_26829f44203fb3b4e46e64e229211bda_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Grace-ppd.xrm-ms.exe 2026-08-23_26829f44203fb3b4e46e64e229211bda_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\ExcelCtxUICellModel.bin.exe 2026-08-23_26829f44203fb3b4e46e64e229211bda_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\cldrdata.jar.exe 2026-08-23_26829f44203fb3b4e46e64e229211bda_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Trial-ppd.xrm-ms 2026-08-23_26829f44203fb3b4e46e64e229211bda_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\libpng.md 2026-08-23_26829f44203fb3b4e46e64e229211bda_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-pl.xrm-ms 2026-08-23_26829f44203fb3b4e46e64e229211bda_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\sv_FEMININE.pak.exe 2026-08-23_26829f44203fb3b4e46e64e229211bda_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jdk-1.8\lib\ir.idl 2026-08-23_26829f44203fb3b4e46e64e229211bda_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jre-1.8\bin\javafx_font.dll.exe 2026-08-23_26829f44203fb3b4e46e64e229211bda_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_ja.properties.exe 2026-08-23_26829f44203fb3b4e46e64e229211bda_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-xstate-l2-1-0.dll.exe 2026-08-23_26829f44203fb3b4e46e64e229211bda_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Orange.xml.exe 2026-08-23_26829f44203fb3b4e46e64e229211bda_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-ul-oob.xrm-ms 2026-08-23_26829f44203fb3b4e46e64e229211bda_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.PowerBI.AdomdClient.dll 2026-08-23_26829f44203fb3b4e46e64e229211bda_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientCapabilities.json 2026-08-23_26829f44203fb3b4e46e64e229211bda_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\it_FEMININE.pak.exe 2026-08-23_26829f44203fb3b4e46e64e229211bda_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Grace-ppd.xrm-ms.exe 2026-08-23_26829f44203fb3b4e46e64e229211bda_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremDemoR_BypassTrial365-ul-oob.xrm-ms 2026-08-23_26829f44203fb3b4e46e64e229211bda_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jre-1.8\README.txt 2026-08-23_26829f44203fb3b4e46e64e229211bda_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-ppd.xrm-ms 2026-08-23_26829f44203fb3b4e46e64e229211bda_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_F_COL.HXK.exe 2026-08-23_26829f44203fb3b4e46e64e229211bda_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-pl.xrm-ms.exe 2026-08-23_26829f44203fb3b4e46e64e229211bda_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\TelemetryDashboard.xltx 2026-08-23_26829f44203fb3b4e46e64e229211bda_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\VisualElements\SmallLogo.png 2026-08-23_26829f44203fb3b4e46e64e229211bda_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-ul-oob.xrm-ms.exe 2026-08-23_26829f44203fb3b4e46e64e229211bda_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ul-oob.xrm-ms.exe 2026-08-23_26829f44203fb3b4e46e64e229211bda_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-ppd.xrm-ms.exe 2026-08-23_26829f44203fb3b4e46e64e229211bda_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTOCOLHANDLERINTL.DLL 2026-08-23_26829f44203fb3b4e46e64e229211bda_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\plugin2\vcruntime140.dll 2026-08-23_26829f44203fb3b4e46e64e229211bda_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-pl.xrm-ms 2026-08-23_26829f44203fb3b4e46e64e229211bda_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ppd.xrm-ms 2026-08-23_26829f44203fb3b4e46e64e229211bda_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\OUTEX2.ECF 2026-08-23_26829f44203fb3b4e46e64e229211bda_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\7-Zip\Lang\sw.txt.exe 2026-08-23_26829f44203fb3b4e46e64e229211bda_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipRes.dll.mui.exe 2026-08-23_26829f44203fb3b4e46e64e229211bda_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_Subscription-ul-oob.xrm-ms 2026-08-23_26829f44203fb3b4e46e64e229211bda_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicelegant.dotx.exe 2026-08-23_26829f44203fb3b4e46e64e229211bda_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\accessibility.properties.exe 2026-08-23_26829f44203fb3b4e46e64e229211bda_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial.xml.exe 2026-08-23_26829f44203fb3b4e46e64e229211bda_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ink\kok-IN\tipresx.dll.mui.exe 2026-08-23_26829f44203fb3b4e46e64e229211bda_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-ul-oob.xrm-ms.exe 2026-08-23_26829f44203fb3b4e46e64e229211bda_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_KMS_Client_AE-ppd.xrm-ms.exe 2026-08-23_26829f44203fb3b4e46e64e229211bda_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ppd.xrm-ms.exe 2026-08-23_26829f44203fb3b4e46e64e229211bda_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\7-Zip\Lang\co.txt 2026-08-23_26829f44203fb3b4e46e64e229211bda_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\ConvertEnter.eps 2026-08-23_26829f44203fb3b4e46e64e229211bda_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\hr.pak 2026-08-23_26829f44203fb3b4e46e64e229211bda_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-pl.xrm-ms.exe 2026-08-23_26829f44203fb3b4e46e64e229211bda_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-ul-phn.xrm-ms.exe 2026-08-23_26829f44203fb3b4e46e64e229211bda_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-ul-oob.xrm-ms.exe 2026-08-23_26829f44203fb3b4e46e64e229211bda_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\OUTLVBA.DLL.exe 2026-08-23_26829f44203fb3b4e46e64e229211bda_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\MMSL.ICO.exe 2026-08-23_26829f44203fb3b4e46e64e229211bda_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTrial-ul-oob.xrm-ms.exe 2026-08-23_26829f44203fb3b4e46e64e229211bda_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll.exe 2026-08-23_26829f44203fb3b4e46e64e229211bda_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.16.xml.exe 2026-08-23_26829f44203fb3b4e46e64e229211bda_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\pt-BR.pak.exe 2026-08-23_26829f44203fb3b4e46e64e229211bda_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jre-1.8\COPYRIGHT.exe 2026-08-23_26829f44203fb3b4e46e64e229211bda_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2native.dll 2026-08-23_26829f44203fb3b4e46e64e229211bda_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md.exe 2026-08-23_26829f44203fb3b4e46e64e229211bda_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Grace-ul-oob.xrm-ms.exe 2026-08-23_26829f44203fb3b4e46e64e229211bda_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-ul-oob.xrm-ms 2026-08-23_26829f44203fb3b4e46e64e229211bda_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\SHARING.CFG 2026-08-23_26829f44203fb3b4e46e64e229211bda_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\rtscom.dll.mui.exe 2026-08-23_26829f44203fb3b4e46e64e229211bda_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\hi_FEMININE.pak.exe 2026-08-23_26829f44203fb3b4e46e64e229211bda_coinminer_glassworm_poet-rat_sliver_snatch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-23_26829f44203fb3b4e46e64e229211bda_coinminer_glassworm_poet-rat_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-23_26829f44203fb3b4e46e64e229211bda_coinminer_glassworm_poet-rat_sliver_snatch.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:3824
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7-zip32.dll
- Size 25.7MB
- SHA256 f0b23ad5d555cb50d20dd06a1f4d29b95c44a1cb4c42fcd2acd7f80c267f2117
- MD5 2dbe5a1d75cf3824f3dc2fcb31dd146e
- SHA1 3f547ad0fff51920e7a8ea5b4d53f620a19a2544
- SHA512 91f12c83db2516cff3042b249716078fda8a439db99e397c15c2f866b063eaed1f985c4605d573cec76271536df8c9eb84601ba53c2eee4ae452cfeac6f95b82
- SSDEEP 393216:v/HNRBR/RORXRURXR/ROR8R/RXRNRaR/R/RmR/RXRyRmRXRORxRHRuRXRRRXRxRc:38
- TLSH T1E047BF2177E84AAAC2EFD37AE07206161FF1F527622BEB4F5D8444FA1D43B909911363
- MD5 SHA1 SHA512 SSDEEP TLSH