Analysis
- max time kernel
148s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/09/2026, 16:50
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-09-04_1ef564ccf8bc97784c10ef48ceadd13e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-04_1ef564ccf8bc97784c10ef48ceadd13e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target 2026-09-04_1ef564ccf8bc97784c10ef48ceadd13e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
- Size 7.0MB
- Sample260905-vb8jpav1dz
- SHA256 2e9d044b25ca3192ab73f44b2bcedfa6b3b3e2f50b11272dbff391d7897f6a10
- MD5 1ef564ccf8bc97784c10ef48ceadd13e
- SHA1 ae774a56209d616974dbfd6d5e6a3a66a20dc358
- SHA512 583b3dc6a790dce113c1c30db21de08fe9f8e32ac7a06f97a7952fd5ea5cd5809ef4d768f9217d10654d68ab13ac3fa860cbe50ed8ed3f50b90c790bf502ec61
- SSDEEP 98304:nH7arTiFR1r9BkDcz3XXyc+jofX5SDchRRSDchRZ:H7arT4R1r9BHznX7iAhRFhRZ
- TLSH T17E768D33F9E515EAC2BEE1B0855297217E72386B83316B975FC4459B1A22FD0BA3D310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables referencing virtualization MAC addresses 1 IoCs
resource yara_rule behavioral2/files/0x000200000001b221-4.dat INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb - Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-09-04_1ef564ccf8bc97784c10ef48ceadd13e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\INFOMS.ICO.exe 2026-09-04_1ef564ccf8bc97784c10ef48ceadd13e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\OutlookAutoDiscover\NVBELL.NET.XML.exe 2026-09-04_1ef564ccf8bc97784c10ef48ceadd13e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-warning.png.exe 2026-09-04_1ef564ccf8bc97784c10ef48ceadd13e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\vlc.mo 2026-09-04_1ef564ccf8bc97784c10ef48ceadd13e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome.exe.sig.exe 2026-09-04_1ef564ccf8bc97784c10ef48ceadd13e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PPT_WHATSNEW.XML.exe 2026-09-04_1ef564ccf8bc97784c10ef48ceadd13e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\modules\sandbox.luac 2026-09-04_1ef564ccf8bc97784c10ef48ceadd13e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libchorus_flanger_plugin.dll 2026-09-04_1ef564ccf8bc97784c10ef48ceadd13e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Windows Defender\MpEvMsg.dll.exe 2026-09-04_1ef564ccf8bc97784c10ef48ceadd13e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe.exe 2026-09-04_1ef564ccf8bc97784c10ef48ceadd13e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Grace-ul-oob.xrm-ms 2026-09-04_1ef564ccf8bc97784c10ef48ceadd13e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019DemoR_BypassTrial180-ppd.xrm-ms 2026-09-04_1ef564ccf8bc97784c10ef48ceadd13e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\REMOTEL.ICO.exe 2026-09-04_1ef564ccf8bc97784c10ef48ceadd13e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_f3\FA000000003.exe 2026-09-04_1ef564ccf8bc97784c10ef48ceadd13e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AXIS\PREVIEW.GIF.exe 2026-09-04_1ef564ccf8bc97784c10ef48ceadd13e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_dirac_plugin.dll 2026-09-04_1ef564ccf8bc97784c10ef48ceadd13e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libaribcam_plugin.dll.exe 2026-09-04_1ef564ccf8bc97784c10ef48ceadd13e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\7-Zip\Lang\hy.txt 2026-09-04_1ef564ccf8bc97784c10ef48ceadd13e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msix.dll 2026-09-04_1ef564ccf8bc97784c10ef48ceadd13e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui 2026-09-04_1ef564ccf8bc97784c10ef48ceadd13e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaSansRegular.ttf 2026-09-04_1ef564ccf8bc97784c10ef48ceadd13e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-convert-l1-1-0.dll 2026-09-04_1ef564ccf8bc97784c10ef48ceadd13e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-pl.xrm-ms 2026-09-04_1ef564ccf8bc97784c10ef48ceadd13e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTrial-ul-oob.xrm-ms.exe 2026-09-04_1ef564ccf8bc97784c10ef48ceadd13e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\VBA7.1\1033\VBEUIINTL.DLL.exe 2026-09-04_1ef564ccf8bc97784c10ef48ceadd13e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\jfxswt.jar 2026-09-04_1ef564ccf8bc97784c10ef48ceadd13e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-handle-l1-1-0.dll.exe 2026-09-04_1ef564ccf8bc97784c10ef48ceadd13e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\charsets.jar 2026-09-04_1ef564ccf8bc97784c10ef48ceadd13e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jre-1.8\lib\security\cacerts.exe 2026-09-04_1ef564ccf8bc97784c10ef48ceadd13e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Office 2007 - 2010.xml 2026-09-04_1ef564ccf8bc97784c10ef48ceadd13e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ul-phn.xrm-ms.exe 2026-09-04_1ef564ccf8bc97784c10ef48ceadd13e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OutlookAutoDiscover\YAHOO.COM.PH.XML 2026-09-04_1ef564ccf8bc97784c10ef48ceadd13e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\BIN\1033\FPEXT.MSG.exe 2026-09-04_1ef564ccf8bc97784c10ef48ceadd13e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\7-Zip\Lang\ta.txt.exe 2026-09-04_1ef564ccf8bc97784c10ef48ceadd13e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ink\uz-Latn-UZ\tipresx.dll.mui.exe 2026-09-04_1ef564ccf8bc97784c10ef48ceadd13e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_zh_TW.properties.exe 2026-09-04_1ef564ccf8bc97784c10ef48ceadd13e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial3-pl.xrm-ms.exe 2026-09-04_1ef564ccf8bc97784c10ef48ceadd13e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\OutlookAutoDiscover\SNET.NET.XML.exe 2026-09-04_1ef564ccf8bc97784c10ef48ceadd13e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Web.Entity.Resources.dll 2026-09-04_1ef564ccf8bc97784c10ef48ceadd13e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\vlc.mo 2026-09-04_1ef564ccf8bc97784c10ef48ceadd13e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\liberase_plugin.dll.exe 2026-09-04_1ef564ccf8bc97784c10ef48ceadd13e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\sqloledb.rll.mui 2026-09-04_1ef564ccf8bc97784c10ef48ceadd13e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\invalid32x32.gif.exe 2026-09-04_1ef564ccf8bc97784c10ef48ceadd13e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ul-phn.xrm-ms 2026-09-04_1ef564ccf8bc97784c10ef48ceadd13e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Excel.dll 2026-09-04_1ef564ccf8bc97784c10ef48ceadd13e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\catalog.json.exe 2026-09-04_1ef564ccf8bc97784c10ef48ceadd13e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\xmsrv_xl.dll 2026-09-04_1ef564ccf8bc97784c10ef48ceadd13e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\api-ms-win-crt-time-l1-1-0.dll 2026-09-04_1ef564ccf8bc97784c10ef48ceadd13e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe.exe 2026-09-04_1ef564ccf8bc97784c10ef48ceadd13e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\MEIPreload\manifest.json 2026-09-04_1ef564ccf8bc97784c10ef48ceadd13e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-conio-l1-1-0.dll 2026-09-04_1ef564ccf8bc97784c10ef48ceadd13e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-time-l1-1-0.dll 2026-09-04_1ef564ccf8bc97784c10ef48ceadd13e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7ES.LEX.exe 2026-09-04_1ef564ccf8bc97784c10ef48ceadd13e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\INDUST\INDUST.ELM.exe 2026-09-04_1ef564ccf8bc97784c10ef48ceadd13e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe 2026-09-04_1ef564ccf8bc97784c10ef48ceadd13e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.IdentityModel.Selectors.Resources.dll 2026-09-04_1ef564ccf8bc97784c10ef48ceadd13e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\lua\intf\modules\httprequests.luac.exe 2026-09-04_1ef564ccf8bc97784c10ef48ceadd13e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml.exe 2026-09-04_1ef564ccf8bc97784c10ef48ceadd13e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml 2026-09-04_1ef564ccf8bc97784c10ef48ceadd13e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-heap-l1-1-0.dll 2026-09-04_1ef564ccf8bc97784c10ef48ceadd13e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TEXTCONV\RECOVR32.CNV.exe 2026-09-04_1ef564ccf8bc97784c10ef48ceadd13e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\visualization\libprojectm_plugin.dll 2026-09-04_1ef564ccf8bc97784c10ef48ceadd13e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\rtscom.dll.mui 2026-09-04_1ef564ccf8bc97784c10ef48ceadd13e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\ko_NEUTER.pak.exe 2026-09-04_1ef564ccf8bc97784c10ef48ceadd13e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-04_1ef564ccf8bc97784c10ef48ceadd13e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-04_1ef564ccf8bc97784c10ef48ceadd13e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:760
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7-zip32.dll
- Size 7.6MB
- SHA256 81d98fb435bd153096ab1593d8e8ad5da2d9c2bf7314fd7b09b9f738e7329a61
- MD5 443de8066db5447ab50afe94ebf81381
- SHA1 4f0f1773daaad4231939a76efac03e110bfe206a
- SHA512 5e8600fa663132229a6dad8f970d6400d0179c76dfa1b8bb61ceb645701942df310659278c512f8143787e8ade9091a33dc4fe00a69dfc740a2ce07489307fdb
- SSDEEP 98304:nH7arTiFR1r9BkDcz3XXyc+jofX5SDchRRSDchRYSDchRc:H7arT4R1r9BHznX7iAhRFhR6hRc
- TLSH T1B0869D33F9E505EAC2BEE1B0C16297217E71786B83216B975FC445AA1A13FD0AE3D311
- MD5 SHA1 SHA512 SSDEEP TLSH