Analysis
- max time kernel
150s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/09/2026, 15:25
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-09-09_96b5fc1e9db28a5bd25099dce94f1c85_coinminer_glassworm_poet-rat_sliver_snatch.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-09_96b5fc1e9db28a5bd25099dce94f1c85_coinminer_glassworm_poet-rat_sliver_snatch.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target 2026-09-09_96b5fc1e9db28a5bd25099dce94f1c85_coinminer_glassworm_poet-rat_sliver_snatch.exe
- Size 18.8MB
- Sample260909-st4mcayvds
- SHA256 3daf5cb9bf080935b8674e937aa522083176a0d0060e4ebdb8af98e7404124d4
- MD5 96b5fc1e9db28a5bd25099dce94f1c85
- SHA1 ea3cd086ed31975441c759acd16235e3ad4e80ff
- SHA512 4e3684e16ba82bc6c68d61c55cb20a611e0c2b08de7a5a3235af193916bcf1cff812cd2fdab79e737638604092f738136d115f26dab4d123b145359624562f3b
- SSDEEP 393216:b/HNRBR/RORXRURXR/RORORXR/RmRORXRORyRORFR+Rc:Lu
- TLSH T1C817BF32B7E84AAAC2FFD379D06206261FF1B4276227EB4F5D8444FA1D13B909915363
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables referencing virtualization MAC addresses 1 IoCs
resource yara_rule behavioral2/files/0x000200000001b2fd-4.dat INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb - Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-09-09_96b5fc1e9db28a5bd25099dce94f1c85_coinminer_glassworm_poet-rat_sliver_snatch.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.ProgressiveProcessing.dll 2026-09-09_96b5fc1e9db28a5bd25099dce94f1c85_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jre-1.8\Welcome.html.exe 2026-09-09_96b5fc1e9db28a5bd25099dce94f1c85_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\plugin2\npjp2.dll 2026-09-09_96b5fc1e9db28a5bd25099dce94f1c85_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime2019_eula.txt.exe 2026-09-09_96b5fc1e9db28a5bd25099dce94f1c85_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\zlib.md.exe 2026-09-09_96b5fc1e9db28a5bd25099dce94f1c85_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-pl.xrm-ms.exe 2026-09-09_96b5fc1e9db28a5bd25099dce94f1c85_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\MSQRY32.CHM.exe 2026-09-09_96b5fc1e9db28a5bd25099dce94f1c85_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\OutlookMeetingReqReadNaiveBayesCommandRanker.txt.exe 2026-09-09_96b5fc1e9db28a5bd25099dce94f1c85_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\TellMeOneNote.nrr 2026-09-09_96b5fc1e9db28a5bd25099dce94f1c85_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\ExcelCtxUICellModel.bin.exe 2026-09-09_96b5fc1e9db28a5bd25099dce94f1c85_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] 2026-09-09_96b5fc1e9db28a5bd25099dce94f1c85_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spc.txt 2026-09-09_96b5fc1e9db28a5bd25099dce94f1c85_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java_crw_demo.dll 2026-09-09_96b5fc1e9db28a5bd25099dce94f1c85_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-ul-oob.xrm-ms 2026-09-09_96b5fc1e9db28a5bd25099dce94f1c85_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer2019_eula.txt 2026-09-09_96b5fc1e9db28a5bd25099dce94f1c85_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\dcf.x-none.msi.16.x-none.tree.dat 2026-09-09_96b5fc1e9db28a5bd25099dce94f1c85_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\ro_FEMININE.pak.exe 2026-09-09_96b5fc1e9db28a5bd25099dce94f1c85_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\ZeroByteFile.exe 2026-09-09_96b5fc1e9db28a5bd25099dce94f1c85_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\outlookmui.msi.16.en-us.tree.dat 2026-09-09_96b5fc1e9db28a5bd25099dce94f1c85_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\zh-CN_NEUTER.pak.exe 2026-09-09_96b5fc1e9db28a5bd25099dce94f1c85_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-ppd.xrm-ms 2026-09-09_96b5fc1e9db28a5bd25099dce94f1c85_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART10.BDR.exe 2026-09-09_96b5fc1e9db28a5bd25099dce94f1c85_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\SECURE.CFG 2026-09-09_96b5fc1e9db28a5bd25099dce94f1c85_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\OsfTaskengine.dll.exe 2026-09-09_96b5fc1e9db28a5bd25099dce94f1c85_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-ppd.xrm-ms.exe 2026-09-09_96b5fc1e9db28a5bd25099dce94f1c85_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\vccorlib140.dll 2026-09-09_96b5fc1e9db28a5bd25099dce94f1c85_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\deploy\ffjcext.zip 2026-09-09_96b5fc1e9db28a5bd25099dce94f1c85_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-ppd.xrm-ms.exe 2026-09-09_96b5fc1e9db28a5bd25099dce94f1c85_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\lv.pak.exe 2026-09-09_96b5fc1e9db28a5bd25099dce94f1c85_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Trial-pl.xrm-ms.exe 2026-09-09_96b5fc1e9db28a5bd25099dce94f1c85_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_f4\FA000000005.exe 2026-09-09_96b5fc1e9db28a5bd25099dce94f1c85_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_profile.png 2026-09-09_96b5fc1e9db28a5bd25099dce94f1c85_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-80.png.exe 2026-09-09_96b5fc1e9db28a5bd25099dce94f1c85_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\7-Zip\Lang\cs.txt.exe 2026-09-09_96b5fc1e9db28a5bd25099dce94f1c85_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\gu_FEMININE.pak 2026-09-09_96b5fc1e9db28a5bd25099dce94f1c85_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\OutlookAutoDiscover\FLASH.NET.XML.exe 2026-09-09_96b5fc1e9db28a5bd25099dce94f1c85_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui.exe 2026-09-09_96b5fc1e9db28a5bd25099dce94f1c85_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt 2026-09-09_96b5fc1e9db28a5bd25099dce94f1c85_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription4-ul-oob.xrm-ms.exe 2026-09-09_96b5fc1e9db28a5bd25099dce94f1c85_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Trial-pl.xrm-ms.exe 2026-09-09_96b5fc1e9db28a5bd25099dce94f1c85_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-pl.xrm-ms 2026-09-09_96b5fc1e9db28a5bd25099dce94f1c85_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSZIP.DIC 2026-09-09_96b5fc1e9db28a5bd25099dce94f1c85_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 2026-09-09_96b5fc1e9db28a5bd25099dce94f1c85_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\rsod\osm.x-none.msi.16.x-none.tree.dat.exe 2026-09-09_96b5fc1e9db28a5bd25099dce94f1c85_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l2-1-0.dll 2026-09-09_96b5fc1e9db28a5bd25099dce94f1c85_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\fonts\LucidaSansRegular.ttf 2026-09-09_96b5fc1e9db28a5bd25099dce94f1c85_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-ul-oob.xrm-ms.exe 2026-09-09_96b5fc1e9db28a5bd25099dce94f1c85_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-ul-oob.xrm-ms 2026-09-09_96b5fc1e9db28a5bd25099dce94f1c85_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-140.png 2026-09-09_96b5fc1e9db28a5bd25099dce94f1c85_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-140.png 2026-09-09_96b5fc1e9db28a5bd25099dce94f1c85_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7FR.DLL.exe 2026-09-09_96b5fc1e9db28a5bd25099dce94f1c85_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\notice.txt 2026-09-09_96b5fc1e9db28a5bd25099dce94f1c85_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll 2026-09-09_96b5fc1e9db28a5bd25099dce94f1c85_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-string-l1-1-0.dll.exe 2026-09-09_96b5fc1e9db28a5bd25099dce94f1c85_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-pl.xrm-ms.exe 2026-09-09_96b5fc1e9db28a5bd25099dce94f1c85_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-process-l1-1-0.dll 2026-09-09_96b5fc1e9db28a5bd25099dce94f1c85_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 2026-09-09_96b5fc1e9db28a5bd25099dce94f1c85_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\7-Zip\Lang\is.txt 2026-09-09_96b5fc1e9db28a5bd25099dce94f1c85_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\pt-PT_MASCULINE.pak.exe 2026-09-09_96b5fc1e9db28a5bd25099dce94f1c85_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\asm.md 2026-09-09_96b5fc1e9db28a5bd25099dce94f1c85_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-ul-oob.xrm-ms.exe 2026-09-09_96b5fc1e9db28a5bd25099dce94f1c85_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\WWINTL.DLL.exe 2026-09-09_96b5fc1e9db28a5bd25099dce94f1c85_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLCTL.DLL.exe 2026-09-09_96b5fc1e9db28a5bd25099dce94f1c85_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\MISTRAL.TTF.exe 2026-09-09_96b5fc1e9db28a5bd25099dce94f1c85_coinminer_glassworm_poet-rat_sliver_snatch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-09_96b5fc1e9db28a5bd25099dce94f1c85_coinminer_glassworm_poet-rat_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-09_96b5fc1e9db28a5bd25099dce94f1c85_coinminer_glassworm_poet-rat_sliver_snatch.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:1308
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7-zip32.dll
- Size 19.5MB
- SHA256 63532c141555b360fdd5dbeb1457776e1a419bf8591a429508e1a09e1fba00f1
- MD5 ea6fe6321861466a00e3490ed9d02b2b
- SHA1 5d36323e3fb0ac9b369e70ff531218c4f27ded8a
- SHA512 a99609b89bd28ea1875bcda37e6d079253563b7900af482aa257a9e88997306bae7bbba292f7b074f8185afc6e98da87d5a7e656a3de243960c01f02848e1683
- SSDEEP 393216:b/HNRBR/RORXRURXR/RORORXR/RmRORXRORyRORFR+R/Rc:LE
- TLSH T16B27BF32B7E84AAAC2FFD379D06206261FF1B4276227EB4F5D8444FA1D13B909915363
- MD5 SHA1 SHA512 SSDEEP TLSH