Analysis
- max time kernel
148s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/09/2026, 23:12
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
- Size 9.9MB
- Sample260903-2656datya1
- SHA256 18d2a1661bab8629d8a5f74ba15b981a41af7ff3f4e4ebf57fa91918defc7f63
- MD5 c5040596717abe2d524271fe63693ccf
- SHA1 bde9e11ec82d252c56500cce6280f17533cad4ff
- SHA512 d53f636720241b857092d149e96ef475be8aaac65673e6c8c369a71d614345018de6dfdfe9d5a94065e2e8fb32a02ba4249ab5abb2f32370ef561584476dac39
- SSDEEP 196608:CwAlDycg3oBbqsATtThRBhRHhRshRqhRQhRc:Ts/cRLRBRQR+RMRc
- TLSH T18AA6AF32F6E505EAC6BEE274C06257217EB17C674332BB875F8045B91A63BD0AD2D312
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables referencing virtualization MAC addresses 1 IoCs
resource yara_rule behavioral2/files/0x000d00000001c4e4-4.dat INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mn = "c:\\Windows\\System32\\mn.exe" 2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fW = "c:\\Windows\\System32\\fW.exe" 2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hcqQPxJV = "c:\\Windows\\System32\\hcqQPxJV.exe" 2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe - Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created \??\c:\Windows\System32\mn.exe 2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created \??\c:\Windows\System32\fW.exe 2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created \??\c:\Windows\System32\hcqQPxJV.exe 2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\da.pak.exe 2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\he_NEUTER.pak 2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Xml.Linq.Resources.dll.exe 2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\vlc.mo 2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\vlc.mo 2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll.exe 2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ink\cy-GB\tipresx.dll.mui.exe 2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\en-GB_MASCULINE.pak 2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\javafx\mesa3d.md 2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\msasxpress.dll 2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe 2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Windows Defender\EppManifest.dll 2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Windows Defender\es-ES\OfflineScannerShell.exe.mui 2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\prism_common.dll 2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\net.properties 2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\manifest.xml 2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\rsod\officemui.msi.16.en-us.tree.dat.exe 2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libimage_plugin.dll 2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\SCHDCNCL.CFG.exe 2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-80.png.exe 2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\ca\msipc.dll.mui.exe 2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONPPTAddin.dll 2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] 2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\System\MSCOMCTL.OCX.exe 2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\visualization\libvisual_plugin.dll 2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\7-Zip\7-zip.dll.exe 2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll.exe 2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ink\gu-IN\tipresx.dll.mui 2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jre-1.8\lib\rt.jar.exe 2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ppd.xrm-ms.exe 2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-pl.xrm-ms 2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_KMS_Client_AE-ul.xrm-ms 2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-pl.xrm-ms.exe 2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\fi_FEMININE.pak.exe 2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jre-1.8\lib\cmm\LINEAR_RGB.pf.exe 2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml.exe 2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Trial-ppd.xrm-ms.exe 2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ul-oob.xrm-ms 2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-ul-oob.xrm-ms.exe 2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\EXPTOOWS.DLL.exe 2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\MSO20SKYPEWIN32.DLL 2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-ul-oob.xrm-ms.exe 2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\ISO690.XSL.exe 2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\cacerts.pem.exe 2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Help\HxRuntime.HxS.exe 2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MINSBROAMINGPROXY.DLL 2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\locale\ku_IQ\LC_MESSAGES\vlc.mo.exe 2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_duplicate_plugin.dll.exe 2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Windows Defender\ja-JP\ProtectionManagement_Uninstall.mfl.exe 2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\System\Ole DB\msxactps.dll.exe 2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\vstoee90.tlb 2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml 2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-pl.xrm-ms.exe 2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-pl.xrm-ms.exe 2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-80.png 2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL117.XML 2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\TextIntelligence.dll.exe 2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-ppd.xrm-ms.exe 2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_K_COL.HXK.exe 2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-80.png 2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Windows.Presentation.resources.dll.exe 2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ink\micaut.dll 2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-03_c5040596717abe2d524271fe63693ccf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe"1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
PID:2188
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7-zip.dll.exe
- Size 10.6MB
- SHA256 8c3198dd8e31b761f45a5102157c5a906b1bd4f2d0c675ea56ffc8abf8599622
- MD5 5d70e27f444df9610d8e2fb1ba2c401f
- SHA1 71c6a732f396baf51d26cfc6112a865be136d9c8
- SHA512 b4e3350d65c9a5c70b2427385e82b702542fc80f37d0377cf41baafec5df3ae22bfb459f3aafc62834fec27a9e2cbd7c37d37e4a09dc06335ead045b6d44556d
- SSDEEP 196608:CwAlDycg3oBbqsATtThRBhRHhRshRqhRQhRthR6:Ts/cRLRBRQR+RMR/R6
- TLSH T104B6B032F6E505AEC6BEE274C06257217EB1B8574332BB8B5F8045B91D63BD0AD2D312
- MD5 SHA1 SHA512 SSDEEP TLSH