Analysis
- max time kernel
148s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/09/2026, 11:19
Behavioral task
behavioral1
Sample
2026-09-08_df29ac503c16a3438c456d3f53bfe872_cobalt-strike_coinminer_glassworm_poet-rat.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-08_df29ac503c16a3438c456d3f53bfe872_cobalt-strike_coinminer_glassworm_poet-rat.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-09-08_df29ac503c16a3438c456d3f53bfe872_cobalt-strike_coinminer_glassworm_poet-rat.exe
- Size 9.0MB
- Sample260908-neyekafa98
- SHA256 498eb23f2d3861e8cb9899bb7afa8aff5599a8aabae4f23877366e02d0fff997
- MD5 df29ac503c16a3438c456d3f53bfe872
- SHA1 cf2f72283e7b124f2a3ea6315fcf4b89716371b5
- SHA512 94c3186b4c715f06f877d19ecee148def46c128d58c38fef7d5ed104730004929142a6f31557cd741d68b39c9df1918402fdfce4d68ff9bfd1b7a83a5482a260
- SSDEEP 196608:VmD5q1SGs2y7QNTpWLhR4hRbhRFhR7hRp:4A+FRERtRHRNRp
- TLSH T1FE96AF32F5E509EAC6BFE174C15252227EB17C674332BB875F8055AA1E23BD0AD2E311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
gravityrat
C2
-
https://ent34ndx3cz8k.x.pipedream.net
Signatures
- Family: GravityRAT
GravityRAT is a cross-platform malware an Android, macOS and Windows based RAT first seen in 2015.
- Detects executables referencing virtualization MAC addresses 1 IoCs
resource yara_rule behavioral2/files/0x000d00000001c49b-4.dat INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb - Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-09-08_df29ac503c16a3438c456d3f53bfe872_cobalt-strike_coinminer_glassworm_poet-rat.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created \??\c:\Windows\System32\glhqUM.exe 2026-09-08_df29ac503c16a3438c456d3f53bfe872_cobalt-strike_coinminer_glassworm_poet-rat.exe File created \??\c:\Windows\System32\.exe 2026-09-08_df29ac503c16a3438c456d3f53bfe872_cobalt-strike_coinminer_glassworm_poet-rat.exe File created \??\c:\Windows\System32\vkafGMf.exe 2026-09-08_df29ac503c16a3438c456d3f53bfe872_cobalt-strike_coinminer_glassworm_poet-rat.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-80.png 2026-09-08_df29ac503c16a3438c456d3f53bfe872_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CANYON\PREVIEW.GIF.exe 2026-09-08_df29ac503c16a3438c456d3f53bfe872_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi422_yuy2_mmx_plugin.dll 2026-09-08_df29ac503c16a3438c456d3f53bfe872_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll 2026-09-08_df29ac503c16a3438c456d3f53bfe872_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\sl_FEMININE.pak 2026-09-08_df29ac503c16a3438c456d3f53bfe872_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\uk_MASCULINE.pak.exe 2026-09-08_df29ac503c16a3438c456d3f53bfe872_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\local_policy.jar 2026-09-08_df29ac503c16a3438c456d3f53bfe872_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\Bibliography\BIBFORM.XML 2026-09-08_df29ac503c16a3438c456d3f53bfe872_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\EXPTOOWS.XLA 2026-09-08_df29ac503c16a3438c456d3f53bfe872_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OutlookAutoDiscover\YAHOO.CO.TH.XML 2026-09-08_df29ac503c16a3438c456d3f53bfe872_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-ppd.xrm-ms.exe 2026-09-08_df29ac503c16a3438c456d3f53bfe872_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\OpenSSL64.DllA\libssl-1_1-x64.dll 2026-09-08_df29ac503c16a3438c456d3f53bfe872_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\db2v0801.xsl.exe 2026-09-08_df29ac503c16a3438c456d3f53bfe872_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\7-Zip\Lang\fy.txt.exe 2026-09-08_df29ac503c16a3438c456d3f53bfe872_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.IO.Log.Resources.dll.exe 2026-09-08_df29ac503c16a3438c456d3f53bfe872_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.dll.exe 2026-09-08_df29ac503c16a3438c456d3f53bfe872_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_100_fdf5ce_1x400.png.exe 2026-09-08_df29ac503c16a3438c456d3f53bfe872_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libsamplerate_plugin.dll 2026-09-08_df29ac503c16a3438c456d3f53bfe872_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\misc\libxml_plugin.dll 2026-09-08_df29ac503c16a3438c456d3f53bfe872_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml.exe 2026-09-08_df29ac503c16a3438c456d3f53bfe872_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\cmm\sRGB.pf.exe 2026-09-08_df29ac503c16a3438c456d3f53bfe872_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\dom.md 2026-09-08_df29ac503c16a3438c456d3f53bfe872_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\sv\msipc.dll.mui.exe 2026-09-08_df29ac503c16a3438c456d3f53bfe872_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Management.Instrumentation.Resources.dll.exe 2026-09-08_df29ac503c16a3438c456d3f53bfe872_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\instrument.dll 2026-09-08_df29ac503c16a3438c456d3f53bfe872_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-80.png.exe 2026-09-08_df29ac503c16a3438c456d3f53bfe872_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-synch-l1-2-0.dll 2026-09-08_df29ac503c16a3438c456d3f53bfe872_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotdaddin.dll 2026-09-08_df29ac503c16a3438c456d3f53bfe872_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\Cultures\OFFICE.ODF.exe 2026-09-08_df29ac503c16a3438c456d3f53bfe872_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libsubtitle_plugin.dll.exe 2026-09-08_df29ac503c16a3438c456d3f53bfe872_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe.exe 2026-09-08_df29ac503c16a3438c456d3f53bfe872_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\hijrah-config-umalqura.properties 2026-09-08_df29ac503c16a3438c456d3f53bfe872_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-pl.xrm-ms 2026-09-08_df29ac503c16a3438c456d3f53bfe872_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ul-oob.xrm-ms 2026-09-08_df29ac503c16a3438c456d3f53bfe872_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.DataStreamer.Excel.dll.exe 2026-09-08_df29ac503c16a3438c456d3f53bfe872_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\Office16\MSZIP.DIC.exe 2026-09-08_df29ac503c16a3438c456d3f53bfe872_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\Office16\TecProxy.dll.exe 2026-09-08_df29ac503c16a3438c456d3f53bfe872_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Common Files\microsoft shared\ink\pl-PL\tipresx.dll.mui.exe 2026-09-08_df29ac503c16a3438c456d3f53bfe872_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-utility-l1-1-0.dll.exe 2026-09-08_df29ac503c16a3438c456d3f53bfe872_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-ul-phn.xrm-ms.exe 2026-09-08_df29ac503c16a3438c456d3f53bfe872_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe.exe 2026-09-08_df29ac503c16a3438c456d3f53bfe872_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_output\libadummy_plugin.dll.exe 2026-09-08_df29ac503c16a3438c456d3f53bfe872_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_output\libvmem_plugin.dll.exe 2026-09-08_df29ac503c16a3438c456d3f53bfe872_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\deploy.jar 2026-09-08_df29ac503c16a3438c456d3f53bfe872_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial1-pl.xrm-ms.exe 2026-09-08_df29ac503c16a3438c456d3f53bfe872_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\GB.XSL.exe 2026-09-08_df29ac503c16a3438c456d3f53bfe872_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 2026-09-08_df29ac503c16a3438c456d3f53bfe872_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Stationery\1033\SEAMARBL.JPG 2026-09-08_df29ac503c16a3438c456d3f53bfe872_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Microsoft.Excel.Amo.Core.dll 2026-09-08_df29ac503c16a3438c456d3f53bfe872_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html 2026-09-08_df29ac503c16a3438c456d3f53bfe872_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libts_plugin.dll.exe 2026-09-08_df29ac503c16a3438c456d3f53bfe872_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Java\jre-1.8\bin\sspi_bridge.dll.exe 2026-09-08_df29ac503c16a3438c456d3f53bfe872_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-ppd.xrm-ms.exe 2026-09-08_df29ac503c16a3438c456d3f53bfe872_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-ul-phn.xrm-ms.exe 2026-09-08_df29ac503c16a3438c456d3f53bfe872_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONRES.DLL 2026-09-08_df29ac503c16a3438c456d3f53bfe872_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Checkmark.png.exe 2026-09-08_df29ac503c16a3438c456d3f53bfe872_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libinvert_plugin.dll.exe 2026-09-08_df29ac503c16a3438c456d3f53bfe872_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Common Files\microsoft shared\ink\eu-ES\tipresx.dll.mui.exe 2026-09-08_df29ac503c16a3438c456d3f53bfe872_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\hi.pak.exe 2026-09-08_df29ac503c16a3438c456d3f53bfe872_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\pt-BR.pak.exe 2026-09-08_df29ac503c16a3438c456d3f53bfe872_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-09-08_df29ac503c16a3438c456d3f53bfe872_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-ul-oob.xrm-ms 2026-09-08_df29ac503c16a3438c456d3f53bfe872_cobalt-strike_coinminer_glassworm_poet-rat.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ul-phn.xrm-ms 2026-09-08_df29ac503c16a3438c456d3f53bfe872_cobalt-strike_coinminer_glassworm_poet-rat.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\Invite or Link.one.exe 2026-09-08_df29ac503c16a3438c456d3f53bfe872_cobalt-strike_coinminer_glassworm_poet-rat.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-08_df29ac503c16a3438c456d3f53bfe872_cobalt-strike_coinminer_glassworm_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-08_df29ac503c16a3438c456d3f53bfe872_cobalt-strike_coinminer_glassworm_poet-rat.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
PID:2416
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7-zip.dll.exe
- Size 9.7MB
- SHA256 c9447a57b9e096a4d4369a50697599bd33693f40f118f3f8a65becb93baf66f0
- MD5 506739722db2ab8be23671f78634fcf6
- SHA1 86058681dfec756a4114d84078610b1d062b3fa5
- SHA512 7cb4022ad911358733ffad2e6bc1bf27469407ffe9d69dafa5b20c301353bbc87e8fcd29fbe9458f0b6cc25cc37e2daddf180dda0d3cb2e556e7df7231d456f6
- SSDEEP 196608:VmD5q1SGs2y7QNTpWLhR4hRbhRFhR7hRqhR5:4A+FRERtRHRNR+R5
- TLSH T1E8A6BF32F6E505EAC6FFE274C05142217EB178675336BB8B5F8055AA1D23BD0AD2E312
- MD5 SHA1 SHA512 SSDEEP TLSH