Analysis
- max time kernel
150s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/09/2026, 19:57
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-09-10_103340a4a301a156078f423c6c8ad715_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-10_103340a4a301a156078f423c6c8ad715_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-09-10_103340a4a301a156078f423c6c8ad715_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
- Size 7.6MB
- Sample260910-ypbzesvgpe
- SHA256 b96793ed482cafcb082da7d1871629eb72e1891370149c9cdc7e025ca57d5cb8
- MD5 103340a4a301a156078f423c6c8ad715
- SHA1 9d3c4fde4d7baea085aba69af6c1b86ecb7af65a
- SHA512 40fac58cdebf4cffc2096e590205d8fb05b7a9e3828a9c8de1fd97da5eed663b1eeeaf87c3869889061212ceda7c4ce19c15f4efd76f7cee18e61084cff2f41a
- SSDEEP 98304:nH7arTiFR1r9BkDcz3XXyc+jofX5SDchRISDchRtSDchRc:H7arT4R1r9BHznX7iAhRqhRxhRc
- TLSH T14F869D33F9E505EAC2BEE1B0C16297217E71786B83216B975FC445AA1A13FD0AE3D311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
gravityrat
C2
-
https://en7dftkjiipor.x.pipedream.net
Signatures
- Family: GravityRAT
GravityRAT is a cross-platform malware an Android, macOS and Windows based RAT first seen in 2015.
- Detects executables referencing virtualization MAC addresses 1 IoCs
resource yara_rule behavioral2/files/0x000400000001b2c6-4.dat INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb - Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-09-10_103340a4a301a156078f423c6c8ad715_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\vcruntime140.dll 2026-09-10_103340a4a301a156078f423c6c8ad715_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ul-oob.xrm-ms 2026-09-10_103340a4a301a156078f423c6c8ad715_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\System\FM20.DLL 2026-09-10_103340a4a301a156078f423c6c8ad715_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Linq.dll.exe 2026-09-10_103340a4a301a156078f423c6c8ad715_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui 2026-09-10_103340a4a301a156078f423c6c8ad715_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jdk-1.8\include\classfile_constants.h 2026-09-10_103340a4a301a156078f423c6c8ad715_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessDemoR_BypassTrial365-ppd.xrm-ms 2026-09-10_103340a4a301a156078f423c6c8ad715_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ucrtbase.dll 2026-09-10_103340a4a301a156078f423c6c8ad715_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_COL.HXT 2026-09-10_103340a4a301a156078f423c6c8ad715_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-80.png 2026-09-10_103340a4a301a156078f423c6c8ad715_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN075.XML 2026-09-10_103340a4a301a156078f423c6c8ad715_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PROOF\msth8ES.DLL 2026-09-10_103340a4a301a156078f423c6c8ad715_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\ApothecaryLetter.dotx.exe 2026-09-10_103340a4a301a156078f423c6c8ad715_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Entity.Resources.dll 2026-09-10_103340a4a301a156078f423c6c8ad715_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\npt.dll 2026-09-10_103340a4a301a156078f423c6c8ad715_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\OutlookApptNaiveBayesCommandRanker.txt.exe 2026-09-10_103340a4a301a156078f423c6c8ad715_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\AssetLibrary.ico.exe 2026-09-10_103340a4a301a156078f423c6c8ad715_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\PresentationBuildTasks.resources.dll 2026-09-10_103340a4a301a156078f423c6c8ad715_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hu-hu.dll.exe 2026-09-10_103340a4a301a156078f423c6c8ad715_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\fa_MASCULINE.pak 2026-09-10_103340a4a301a156078f423c6c8ad715_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\pt-BR.pak 2026-09-10_103340a4a301a156078f423c6c8ad715_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-time-l1-1-0.dll 2026-09-10_103340a4a301a156078f423c6c8ad715_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Aspect.xml 2026-09-10_103340a4a301a156078f423c6c8ad715_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-ppd.xrm-ms 2026-09-10_103340a4a301a156078f423c6c8ad715_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ul-oob.xrm-ms 2026-09-10_103340a4a301a156078f423c6c8ad715_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_F_COL.HXK 2026-09-10_103340a4a301a156078f423c6c8ad715_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\ro_FEMININE.pak.exe 2026-09-10_103340a4a301a156078f423c6c8ad715_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jre-1.8\bin\jfxmedia.dll.exe 2026-09-10_103340a4a301a156078f423c6c8ad715_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-ul-oob.xrm-ms.exe 2026-09-10_103340a4a301a156078f423c6c8ad715_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office15\pidgenx.dll 2026-09-10_103340a4a301a156078f423c6c8ad715_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.Interfaces.dll 2026-09-10_103340a4a301a156078f423c6c8ad715_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\msvcr120.dll 2026-09-10_103340a4a301a156078f423c6c8ad715_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\ExcelTellMeOnnxModel.bin.exe 2026-09-10_103340a4a301a156078f423c6c8ad715_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\OutlookAutoDiscover\YAHOO.DE.XML.exe 2026-09-10_103340a4a301a156078f423c6c8ad715_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui 2026-09-10_103340a4a301a156078f423c6c8ad715_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ppd.xrm-ms.exe 2026-09-10_103340a4a301a156078f423c6c8ad715_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\api-ms-win-crt-conio-l1-1-0.dll 2026-09-10_103340a4a301a156078f423c6c8ad715_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE.exe 2026-09-10_103340a4a301a156078f423c6c8ad715_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\Microsoft.Build.Engine.resources.dll.exe 2026-09-10_103340a4a301a156078f423c6c8ad715_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msaddsr.dll.mui 2026-09-10_103340a4a301a156078f423c6c8ad715_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\sl_MASCULINE.pak.exe 2026-09-10_103340a4a301a156078f423c6c8ad715_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms 2026-09-10_103340a4a301a156078f423c6c8ad715_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial-ppd.xrm-ms 2026-09-10_103340a4a301a156078f423c6c8ad715_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libaribcam_plugin.dll 2026-09-10_103340a4a301a156078f423c6c8ad715_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\System\en-US\wab32res.dll.mui 2026-09-10_103340a4a301a156078f423c6c8ad715_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\fr_MASCULINE.pak.exe 2026-09-10_103340a4a301a156078f423c6c8ad715_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-pl.xrm-ms.exe 2026-09-10_103340a4a301a156078f423c6c8ad715_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-ul-oob.xrm-ms 2026-09-10_103340a4a301a156078f423c6c8ad715_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\vlc.mo 2026-09-10_103340a4a301a156078f423c6c8ad715_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\vlc.mo 2026-09-10_103340a4a301a156078f423c6c8ad715_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Grace-ul-oob.xrm-ms.exe 2026-09-10_103340a4a301a156078f423c6c8ad715_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-pl.xrm-ms.exe 2026-09-10_103340a4a301a156078f423c6c8ad715_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\pl\msipc.dll.mui.exe 2026-09-10_103340a4a301a156078f423c6c8ad715_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] 2026-09-10_103340a4a301a156078f423c6c8ad715_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 2026-09-10_103340a4a301a156078f423c6c8ad715_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\vlc.mo.exe 2026-09-10_103340a4a301a156078f423c6c8ad715_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_livehttp_plugin.dll 2026-09-10_103340a4a301a156078f423c6c8ad715_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Mozilla Firefox\update-settings.ini 2026-09-10_103340a4a301a156078f423c6c8ad715_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Web.Entity.Design.Resources.dll.exe 2026-09-10_103340a4a301a156078f423c6c8ad715_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe.exe 2026-09-10_103340a4a301a156078f423c6c8ad715_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 2026-09-10_103340a4a301a156078f423c6c8ad715_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\vlc.mo.exe 2026-09-10_103340a4a301a156078f423c6c8ad715_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libcaf_plugin.dll 2026-09-10_103340a4a301a156078f423c6c8ad715_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\7-Zip\7-zip.dll 2026-09-10_103340a4a301a156078f423c6c8ad715_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-10_103340a4a301a156078f423c6c8ad715_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-10_103340a4a301a156078f423c6c8ad715_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:4448
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7-zip32.dll
- Size 8.2MB
- SHA256 f315b9b995f9e3deaf55e10316eccee0cc141c48cab1e22a050de2337a5f963a
- MD5 fd9025aedeaea9b83368e8d596356143
- SHA1 1a920fad7dca99d9cddfa6d4eb3cdcb30d78c20f
- SHA512 a20e6d25f0e71a5b88e63ceae92c6c1080ab05bc650618e5870d00cd963da2538fe7cdc756234702a8c21e8f214d7cd96acdb930799aa821dfa492d8bb381ffa
- SSDEEP 98304:nH7arTiFR1r9BkDcz3XXyc+jofX5SDchRISDchRtSDchRZSDchRc:H7arT4R1r9BHznX7iAhRqhRxhRthRc
- TLSH T16286AE33F9E505EAC2BEE2B4C16297217E71746B4321BB875FC445EA1A13BD0AE2D311
- MD5 SHA1 SHA512 SSDEEP TLSH