Analysis
- max time kernel
150s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/08/2026, 16:10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-23_1ca3996b66de9d1e20c660579f3983a0_coinminer_glassworm_poet-rat_sliver_snatch.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-23_1ca3996b66de9d1e20c660579f3983a0_coinminer_glassworm_poet-rat_sliver_snatch.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target 2026-08-23_1ca3996b66de9d1e20c660579f3983a0_coinminer_glassworm_poet-rat_sliver_snatch.exe
- Size 18.9MB
- Sample260824-tmpehswwdv
- SHA256 55064b6e03a37f043780f4fb8f540cb4b509cc3a9366152e8bf4441c89660edc
- MD5 1ca3996b66de9d1e20c660579f3983a0
- SHA1 584892eee9bf74648065d9ebcb74cae8174287d6
- SHA512 33660fa15e952ca6f645c86a6141468451bc54232f3c8934c051d1923e50cb7b43928782c999c8b83d1efc145f1e526ddd79470ddb7eee5c5594690e89750ab4
- SSDEEP 393216:v/HNRBR/RORXRURXR/ROR8R/RXROR/RXRHRyR/RXRuRk:3Z
- TLSH T14717CF32B7E84AAAC2FFD379D06206261FF1B4276227EB4F5D8444FA1D13B909915363
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables referencing virtualization MAC addresses 1 IoCs
resource yara_rule behavioral2/files/0x000200000001b2d6-4.dat INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb - Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-08-23_1ca3996b66de9d1e20c660579f3983a0_coinminer_glassworm_poet-rat_sliver_snatch.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-100.png 2026-08-23_1ca3996b66de9d1e20c660579f3983a0_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOCRRES.ORP.exe 2026-08-23_1ca3996b66de9d1e20c660579f3983a0_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\rt.jar 2026-08-23_1ca3996b66de9d1e20c660579f3983a0_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_KMS_ClientC2R-ul.xrm-ms 2026-08-23_1ca3996b66de9d1e20c660579f3983a0_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\SOCIALCONNECTORRES.DLL 2026-08-23_1ca3996b66de9d1e20c660579f3983a0_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-100.png 2026-08-23_1ca3996b66de9d1e20c660579f3983a0_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\System\ado\de-DE\msader15.dll.mui 2026-08-23_1ca3996b66de9d1e20c660579f3983a0_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.uk-ua.dll.exe 2026-08-23_1ca3996b66de9d1e20c660579f3983a0_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\jcup.md 2026-08-23_1ca3996b66de9d1e20c660579f3983a0_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Trial-ul-oob.xrm-ms 2026-08-23_1ca3996b66de9d1e20c660579f3983a0_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xalan.md.exe 2026-08-23_1ca3996b66de9d1e20c660579f3983a0_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md 2026-08-23_1ca3996b66de9d1e20c660579f3983a0_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-pl.xrm-ms 2026-08-23_1ca3996b66de9d1e20c660579f3983a0_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-pl.xrm-ms 2026-08-23_1ca3996b66de9d1e20c660579f3983a0_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipTsf.dll.mui.exe 2026-08-23_1ca3996b66de9d1e20c660579f3983a0_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\sound.properties.exe 2026-08-23_1ca3996b66de9d1e20c660579f3983a0_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] 2026-08-23_1ca3996b66de9d1e20c660579f3983a0_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ink\qps-plocm\tipresx.dll.mui.exe 2026-08-23_1ca3996b66de9d1e20c660579f3983a0_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16ConsumerPerp_Bypass30-ppd.xrm-ms.exe 2026-08-23_1ca3996b66de9d1e20c660579f3983a0_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-ppd.xrm-ms.exe 2026-08-23_1ca3996b66de9d1e20c660579f3983a0_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\pl\msipc.dll.mui 2026-08-23_1ca3996b66de9d1e20c660579f3983a0_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\OutlookAutoDiscover\SBCGLOBAL.NET.XML.exe 2026-08-23_1ca3996b66de9d1e20c660579f3983a0_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\7-Zip\Lang\he.txt 2026-08-23_1ca3996b66de9d1e20c660579f3983a0_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ink\mshwgst.dll 2026-08-23_1ca3996b66de9d1e20c660579f3983a0_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-ul-oob.xrm-ms 2026-08-23_1ca3996b66de9d1e20c660579f3983a0_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime_eula.txt.exe 2026-08-23_1ca3996b66de9d1e20c660579f3983a0_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\as90.xsl 2026-08-23_1ca3996b66de9d1e20c660579f3983a0_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 2026-08-23_1ca3996b66de9d1e20c660579f3983a0_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ink\fa-IR\tipresx.dll.mui.exe 2026-08-23_1ca3996b66de9d1e20c660579f3983a0_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\el_NEUTER.pak.exe 2026-08-23_1ca3996b66de9d1e20c660579f3983a0_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\en\LocalizedStrings.xml.exe 2026-08-23_1ca3996b66de9d1e20c660579f3983a0_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\OOFL.ICO 2026-08-23_1ca3996b66de9d1e20c660579f3983a0_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\SECRECL.ICO 2026-08-23_1ca3996b66de9d1e20c660579f3983a0_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] 2026-08-23_1ca3996b66de9d1e20c660579f3983a0_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-pl.xrm-ms 2026-08-23_1ca3996b66de9d1e20c660579f3983a0_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\VCCORLIB140_APP.DLL.exe 2026-08-23_1ca3996b66de9d1e20c660579f3983a0_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Extreme Shadow.eftx 2026-08-23_1ca3996b66de9d1e20c660579f3983a0_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Excel.Themes.dll 2026-08-23_1ca3996b66de9d1e20c660579f3983a0_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL121.XML.exe 2026-08-23_1ca3996b66de9d1e20c660579f3983a0_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLCALL32.DLL 2026-08-23_1ca3996b66de9d1e20c660579f3983a0_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcDemoR_BypassTrial365-ppd.xrm-ms 2026-08-23_1ca3996b66de9d1e20c660579f3983a0_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTest-ul-oob.xrm-ms.exe 2026-08-23_1ca3996b66de9d1e20c660579f3983a0_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\7-Zip\Lang\sr-spl.txt.exe 2026-08-23_1ca3996b66de9d1e20c660579f3983a0_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_Subscription-ul-oob.xrm-ms 2026-08-23_1ca3996b66de9d1e20c660579f3983a0_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINSHELL.DLL 2026-08-23_1ca3996b66de9d1e20c660579f3983a0_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\7-Zip\Lang\ro.txt.exe 2026-08-23_1ca3996b66de9d1e20c660579f3983a0_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msadcor.dll.mui 2026-08-23_1ca3996b66de9d1e20c660579f3983a0_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-file-l2-1-0.dll.exe 2026-08-23_1ca3996b66de9d1e20c660579f3983a0_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\libffi.md.exe 2026-08-23_1ca3996b66de9d1e20c660579f3983a0_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial-ul-oob.xrm-ms.exe 2026-08-23_1ca3996b66de9d1e20c660579f3983a0_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-pl.xrm-ms.exe 2026-08-23_1ca3996b66de9d1e20c660579f3983a0_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-140.png.exe 2026-08-23_1ca3996b66de9d1e20c660579f3983a0_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\en-GB_FEMININE.pak.exe 2026-08-23_1ca3996b66de9d1e20c660579f3983a0_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\nl.pak.exe 2026-08-23_1ca3996b66de9d1e20c660579f3983a0_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ul-phn.xrm-ms 2026-08-23_1ca3996b66de9d1e20c660579f3983a0_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-profile-l1-1-0.dll 2026-08-23_1ca3996b66de9d1e20c660579f3983a0_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.excelmui.msi.16.en-us.xml.exe 2026-08-23_1ca3996b66de9d1e20c660579f3983a0_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\WebView2Loader.dll.exe 2026-08-23_1ca3996b66de9d1e20c660579f3983a0_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ink\gl-ES\tipresx.dll.mui.exe 2026-08-23_1ca3996b66de9d1e20c660579f3983a0_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\classlist 2026-08-23_1ca3996b66de9d1e20c660579f3983a0_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jre-1.8\bin\j2pkcs11.dll.exe 2026-08-23_1ca3996b66de9d1e20c660579f3983a0_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms.exe 2026-08-23_1ca3996b66de9d1e20c660579f3983a0_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Grace-ppd.xrm-ms.exe 2026-08-23_1ca3996b66de9d1e20c660579f3983a0_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\SIST02.XSL 2026-08-23_1ca3996b66de9d1e20c660579f3983a0_coinminer_glassworm_poet-rat_sliver_snatch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-23_1ca3996b66de9d1e20c660579f3983a0_coinminer_glassworm_poet-rat_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-23_1ca3996b66de9d1e20c660579f3983a0_coinminer_glassworm_poet-rat_sliver_snatch.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:2880
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7-zip32.dll
- Size 19.5MB
- SHA256 8f39c05aaac764a31f30047cd35abcec024f3073d8b5504fb55185e1ca48dd7f
- MD5 37bca59bbfe4f88194f80562e3dcf890
- SHA1 84c1fe2c5e411e04b34afdda19f8d19648e850a6
- SHA512 b4464f4c2f2abe5ae45a2df3a1bb1cee34696d9acc8fd4f618e2e215d30defc538962a2624e654551f5589556937d88edfffc38cac5607a7c831e73cda2b59b8
- SSDEEP 393216:v/HNRBR/RORXRURXR/ROR8R/RXROR/RXRHRyR/RXRuRXRc:3h
- TLSH T1E527CF32B7E84AAAC2FFD379D06206261FF1B4276227EB4F5D8444FA1D13B909915363
- MD5 SHA1 SHA512 SSDEEP TLSH