Analysis
- max time kernel
148s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/09/2026, 00:52
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-09-09_0561134b64b233ff9549e6a7be759379_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-09_0561134b64b233ff9549e6a7be759379_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target 2026-09-09_0561134b64b233ff9549e6a7be759379_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
- Size 6.8MB
- Sample260910-a8eyesshrf
- SHA256 d3daedcf9eebaa2da32833c9d795eb59584fea348c69fc3d42933840c943de0e
- MD5 0561134b64b233ff9549e6a7be759379
- SHA1 66badc1fc103bc07968b91a14db46a457b075419
- SHA512 da6463120673370bbb3261bdaea6e4094f470209230c386e29a391eb98f40d9e56f0727c03d4fde0576ac5054327fdee4065e54a45191e6698f2f85128766432
- SSDEEP 98304:nH7arTiFR1r9BkDcz3XXyc+jofX5SDchRtSDchRc:H7arT4R1r9BHznX7iAhRxhRc
- TLSH T1A5768D33F9E515EAC2BEE1B0855297217E72386B83316B975FC4459B1A22FD0BA3D310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables referencing virtualization MAC addresses 1 IoCs
resource yara_rule behavioral2/files/0x000200000001b2fc-4.dat INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb - Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-09-09_0561134b64b233ff9549e6a7be759379_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\legal\javafx\libxml2.md.exe 2026-09-09_0561134b64b233ff9549e6a7be759379_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\CONTACTL.ICO 2026-09-09_0561134b64b233ff9549e6a7be759379_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Mozilla Firefox\install.log.exe 2026-09-09_0561134b64b233ff9549e6a7be759379_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Mozilla Firefox\installation_telemetry.json 2026-09-09_0561134b64b233ff9549e6a7be759379_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial4-pl.xrm-ms 2026-09-09_0561134b64b233ff9549e6a7be759379_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.HostIntegration.Connectors.dll.exe 2026-09-09_0561134b64b233ff9549e6a7be759379_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\MYSL.ICO.exe 2026-09-09_0561134b64b233ff9549e6a7be759379_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLRPC.DLL.exe 2026-09-09_0561134b64b233ff9549e6a7be759379_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\SystemX86\mfc140u.dll.exe 2026-09-09_0561134b64b233ff9549e6a7be759379_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Net.Resources.dll 2026-09-09_0561134b64b233ff9549e6a7be759379_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\net.dll 2026-09-09_0561134b64b233ff9549e6a7be759379_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremDemoR_BypassTrial365-ppd.xrm-ms 2026-09-09_0561134b64b233ff9549e6a7be759379_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-ppd.xrm-ms.exe 2026-09-09_0561134b64b233ff9549e6a7be759379_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\sbicudt58_64.dll 2026-09-09_0561134b64b233ff9549e6a7be759379_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL058.XML.exe 2026-09-09_0561134b64b233ff9549e6a7be759379_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA6\VBE6EXT.OLB.exe 2026-09-09_0561134b64b233ff9549e6a7be759379_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\1033\FM20.CHM 2026-09-09_0561134b64b233ff9549e6a7be759379_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.ComponentModel.DataAnnotations.dll.exe 2026-09-09_0561134b64b233ff9549e6a7be759379_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\OUTLOOK_WHATSNEW.XML 2026-09-09_0561134b64b233ff9549e6a7be759379_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL112.XML.exe 2026-09-09_0561134b64b233ff9549e6a7be759379_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\vlc.mo.exe 2026-09-09_0561134b64b233ff9549e6a7be759379_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist.json.exe 2026-09-09_0561134b64b233ff9549e6a7be759379_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpegvideo_plugin.dll.exe 2026-09-09_0561134b64b233ff9549e6a7be759379_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\pl_MASCULINE.pak.exe 2026-09-09_0561134b64b233ff9549e6a7be759379_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-09-09_0561134b64b233ff9549e6a7be759379_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jre-1.8\bin\instrument.dll.exe 2026-09-09_0561134b64b233ff9549e6a7be759379_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\OutlookLogo.contrast-white_scale-80.png 2026-09-09_0561134b64b233ff9549e6a7be759379_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\mset7jp.kic 2026-09-09_0561134b64b233ff9549e6a7be759379_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\Video-48.png 2026-09-09_0561134b64b233ff9549e6a7be759379_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\tabskb.dll.mui 2026-09-09_0561134b64b233ff9549e6a7be759379_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\vi_NEUTER.pak.exe 2026-09-09_0561134b64b233ff9549e6a7be759379_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-ul-oob.xrm-ms.exe 2026-09-09_0561134b64b233ff9549e6a7be759379_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Grace-ul-oob.xrm-ms.exe 2026-09-09_0561134b64b233ff9549e6a7be759379_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ul-phn.xrm-ms 2026-09-09_0561134b64b233ff9549e6a7be759379_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\Classic.dotx.exe 2026-09-09_0561134b64b233ff9549e6a7be759379_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.DataWarehouse.Interfaces.DLL 2026-09-09_0561134b64b233ff9549e6a7be759379_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\DBGCORE.DLL.exe 2026-09-09_0561134b64b233ff9549e6a7be759379_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ink\am-ET\tipresx.dll.mui.exe 2026-09-09_0561134b64b233ff9549e6a7be759379_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\giflib.md 2026-09-09_0561134b64b233ff9549e6a7be759379_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Office 2007 - 2010.xml 2026-09-09_0561134b64b233ff9549e6a7be759379_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\pkeyconfig-office-client15.xrm-ms.exe 2026-09-09_0561134b64b233ff9549e6a7be759379_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\LEELAWAD.TTF.exe 2026-09-09_0561134b64b233ff9549e6a7be759379_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\JOURNAL\JOURNAL.ELM 2026-09-09_0561134b64b233ff9549e6a7be759379_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Northwoods.Go.dll 2026-09-09_0561134b64b233ff9549e6a7be759379_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\plugins\services_discovery\libwindrive_plugin.dll.exe 2026-09-09_0561134b64b233ff9549e6a7be759379_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll.exe 2026-09-09_0561134b64b233ff9549e6a7be759379_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O17EnterpriseVL_Bypass30-ppd.xrm-ms 2026-09-09_0561134b64b233ff9549e6a7be759379_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ul-phn.xrm-ms 2026-09-09_0561134b64b233ff9549e6a7be759379_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\Default.dotx.exe 2026-09-09_0561134b64b233ff9549e6a7be759379_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART2.BDR.exe 2026-09-09_0561134b64b233ff9549e6a7be759379_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Microsoft.Office.Interop.Access.dao.dll.exe 2026-09-09_0561134b64b233ff9549e6a7be759379_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHEV.DLL 2026-09-09_0561134b64b233ff9549e6a7be759379_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.Printing.resources.dll.exe 2026-09-09_0561134b64b233ff9549e6a7be759379_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-09-09_0561134b64b233ff9549e6a7be759379_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\VisualElements\Logo.png 2026-09-09_0561134b64b233ff9549e6a7be759379_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jdk-1.8\bin\vcruntime140.dll.exe 2026-09-09_0561134b64b233ff9549e6a7be759379_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages.properties 2026-09-09_0561134b64b233ff9549e6a7be759379_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Organic.thmx.exe 2026-09-09_0561134b64b233ff9549e6a7be759379_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\SCDCNCLL.ICO.exe 2026-09-09_0561134b64b233ff9549e6a7be759379_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe.exe 2026-09-09_0561134b64b233ff9549e6a7be759379_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Conversion.v3.5.dll.exe 2026-09-09_0561134b64b233ff9549e6a7be759379_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_fr.properties.exe 2026-09-09_0561134b64b233ff9549e6a7be759379_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_KMS_ClientC2R-ppd.xrm-ms.exe 2026-09-09_0561134b64b233ff9549e6a7be759379_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_KMS_Client_AE-ppd.xrm-ms 2026-09-09_0561134b64b233ff9549e6a7be759379_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-09_0561134b64b233ff9549e6a7be759379_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-09_0561134b64b233ff9549e6a7be759379_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:1468
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7-zip32.dll
- Size 7.4MB
- SHA256 f369befa001f65a985fddfe87fe1a137c3ded65688450c58c93484b4cca0ba7f
- MD5 8c4c90f872ba1fc67cd5b2c90b6e16a1
- SHA1 b247a4943205838f311a3e5212bcf651ae50fb30
- SHA512 1ed8cad3e392ab2cfe89dac8c0cb44f9ff4a22cf63a7219c408376412f4c6f10bbf58ddcb34f807b68a582ee48310149ddfca30fc7af630477f5edec78c0dbe9
- SSDEEP 98304:nH7arTiFR1r9BkDcz3XXyc+jofX5SDchRtSDchRZSDchRc:H7arT4R1r9BHznX7iAhRxhRthRc
- TLSH T156768D33F9E505EAC2BEE1B0C16297217E71786B83216B975FC445AA1A13FD0AE3D311
- MD5 SHA1 SHA512 SSDEEP TLSH