Analysis
- max time kernel
150s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/09/2026, 11:53
Behavioral task
behavioral1
Sample
2026-09-11_212862cfdccaf8ec1a8582171201da6d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-11_212862cfdccaf8ec1a8582171201da6d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-09-11_212862cfdccaf8ec1a8582171201da6d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
- Size 8.3MB
- Sample260911-n2bjbael7x
- SHA256 ed742f0963a9f60447cbafc14467d599f9e9da9da6937021ade61138643a8d7e
- MD5 212862cfdccaf8ec1a8582171201da6d
- SHA1 9857e952e24bb8dbe4eb425854b99187505039c3
- SHA512 9aea43eadfc3a8241ead4f2a6fb6702f1fd83e5cf5f5c778f902a3ecfc4fb0b01790c60d21b2de68282378f64d7370deeb30a25074354a9c227c295030fb4dc4
- SSDEEP 98304:nH7arTiFR1r9BkDcz3XXyc+jofX5SDchRqSDchRESDchRwSDchRc:H7arT4R1r9BHznX7iAhREhRGhRyhRc
- TLSH T10C96AE33F9E505EAC2BEE2B4C16297217E71746B4321BB875FC445EA1A13BD0AE2D311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
gravityrat
C2
-
https://en7dftkjiipor.x.pipedream.net
Signatures
- Family: GravityRAT
GravityRAT is a cross-platform malware an Android, macOS and Windows based RAT first seen in 2015.
- Detects executables referencing virtualization MAC addresses 1 IoCs
resource yara_rule behavioral2/files/0x000200000001b221-4.dat INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb - Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-09-11_212862cfdccaf8ec1a8582171201da6d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_COL.HXT 2026-09-11_212862cfdccaf8ec1a8582171201da6d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\lpklegal.txt 2026-09-11_212862cfdccaf8ec1a8582171201da6d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui 2026-09-11_212862cfdccaf8ec1a8582171201da6d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\IwaKeyDistribution\iwa-key-distribution.pb 2026-09-11_212862cfdccaf8ec1a8582171201da6d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\lcms.dll 2026-09-11_212862cfdccaf8ec1a8582171201da6d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-time-l1-1-0.dll 2026-09-11_212862cfdccaf8ec1a8582171201da6d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Grace-ul-oob.xrm-ms 2026-09-11_212862cfdccaf8ec1a8582171201da6d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-ul-oob.xrm-ms.exe 2026-09-11_212862cfdccaf8ec1a8582171201da6d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-ul-phn.xrm-ms.exe 2026-09-11_212862cfdccaf8ec1a8582171201da6d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ink\ca-ES\tipresx.dll.mui.exe 2026-09-11_212862cfdccaf8ec1a8582171201da6d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jre-1.8\LICENSE.exe 2026-09-11_212862cfdccaf8ec1a8582171201da6d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jre-1.8\bin\jfxwebkit.dll.exe 2026-09-11_212862cfdccaf8ec1a8582171201da6d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3102-0000-1000-0000000FF1CE.xml.exe 2026-09-11_212862cfdccaf8ec1a8582171201da6d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-ul-oob.xrm-ms 2026-09-11_212862cfdccaf8ec1a8582171201da6d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\mip_telemetry.dll 2026-09-11_212862cfdccaf8ec1a8582171201da6d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\osmia32.msi.exe 2026-09-11_212862cfdccaf8ec1a8582171201da6d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\1033\VBOB6.CHM 2026-09-11_212862cfdccaf8ec1a8582171201da6d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-profile-l1-1-0.dll 2026-09-11_212862cfdccaf8ec1a8582171201da6d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_PrepidBypass-ul-oob.xrm-ms 2026-09-11_212862cfdccaf8ec1a8582171201da6d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\XLMACRO.CHM.exe 2026-09-11_212862cfdccaf8ec1a8582171201da6d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\concrt140.dll.exe 2026-09-11_212862cfdccaf8ec1a8582171201da6d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libavcodec_plugin.dll 2026-09-11_212862cfdccaf8ec1a8582171201da6d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libvorbis_plugin.dll.exe 2026-09-11_212862cfdccaf8ec1a8582171201da6d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-heap-l1-1-0.dll.exe 2026-09-11_212862cfdccaf8ec1a8582171201da6d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\SMIMEE.CFG 2026-09-11_212862cfdccaf8ec1a8582171201da6d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\WidescreenPresentation.potx.exe 2026-09-11_212862cfdccaf8ec1a8582171201da6d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\oregres.dll 2026-09-11_212862cfdccaf8ec1a8582171201da6d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\api-ms-win-core-synch-l1-2-0.dll 2026-09-11_212862cfdccaf8ec1a8582171201da6d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\vlc.mo.exe 2026-09-11_212862cfdccaf8ec1a8582171201da6d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe.exe 2026-09-11_212862cfdccaf8ec1a8582171201da6d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-pl.xrm-ms 2026-09-11_212862cfdccaf8ec1a8582171201da6d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcDemoR_BypassTrial365-ppd.xrm-ms.exe 2026-09-11_212862cfdccaf8ec1a8582171201da6d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\CERTINTL.DLL.exe 2026-09-11_212862cfdccaf8ec1a8582171201da6d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\SENDTO.DLL.exe 2026-09-11_212862cfdccaf8ec1a8582171201da6d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PROFILE\PREVIEW.GIF.exe 2026-09-11_212862cfdccaf8ec1a8582171201da6d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\vlc.mo.exe 2026-09-11_212862cfdccaf8ec1a8582171201da6d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\lua\playlist\anevia_xml.luac.exe 2026-09-11_212862cfdccaf8ec1a8582171201da6d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll.exe 2026-09-11_212862cfdccaf8ec1a8582171201da6d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\EditRestore.dll.exe 2026-09-11_212862cfdccaf8ec1a8582171201da6d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\rt.jar 2026-09-11_212862cfdccaf8ec1a8582171201da6d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-timezone-l1-1-0.dll.exe 2026-09-11_212862cfdccaf8ec1a8582171201da6d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Stationery\1033\TECHTOOL.GIF.exe 2026-09-11_212862cfdccaf8ec1a8582171201da6d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SPRING\SPRING.INF 2026-09-11_212862cfdccaf8ec1a8582171201da6d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Runtime.dll 2026-09-11_212862cfdccaf8ec1a8582171201da6d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\et_NEUTER.pak 2026-09-11_212862cfdccaf8ec1a8582171201da6d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntimeR_PrepidBypass-ppd.xrm-ms.exe 2026-09-11_212862cfdccaf8ec1a8582171201da6d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_K_COL.HXK.exe 2026-09-11_212862cfdccaf8ec1a8582171201da6d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\api-ms-win-crt-multibyte-l1-1-0.dll 2026-09-11_212862cfdccaf8ec1a8582171201da6d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\PROOF\MSWDS_FR.LEX.exe 2026-09-11_212862cfdccaf8ec1a8582171201da6d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\es-419.pak 2026-09-11_212862cfdccaf8ec1a8582171201da6d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\zh-TW.pak 2026-09-11_212862cfdccaf8ec1a8582171201da6d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Internet Explorer\iexplore.exe.exe 2026-09-11_212862cfdccaf8ec1a8582171201da6d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jdwp.dll 2026-09-11_212862cfdccaf8ec1a8582171201da6d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL.HXS 2026-09-11_212862cfdccaf8ec1a8582171201da6d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 2026-09-11_212862cfdccaf8ec1a8582171201da6d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.it-it.dll 2026-09-11_212862cfdccaf8ec1a8582171201da6d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Schoolbook.xml.exe 2026-09-11_212862cfdccaf8ec1a8582171201da6d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-140.png 2026-09-11_212862cfdccaf8ec1a8582171201da6d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SUMIPNTG\THMBNAIL.PNG 2026-09-11_212862cfdccaf8ec1a8582171201da6d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\vlc.mo.exe 2026-09-11_212862cfdccaf8ec1a8582171201da6d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\offset_window.html 2026-09-11_212862cfdccaf8ec1a8582171201da6d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\santuario.md.exe 2026-09-11_212862cfdccaf8ec1a8582171201da6d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jre-1.8\COPYRIGHT 2026-09-11_212862cfdccaf8ec1a8582171201da6d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-100.png 2026-09-11_212862cfdccaf8ec1a8582171201da6d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-11_212862cfdccaf8ec1a8582171201da6d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-11_212862cfdccaf8ec1a8582171201da6d_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:5804
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7-zip32.dll
- Size 8.9MB
- SHA256 7c628f8bf09f49e0d9300daf765447b420dbe6998649450ce617f0c7e2984c59
- MD5 279c6e7defd2c104a5de64aacbde9542
- SHA1 709b6711ee5d520be9e35ae34709670830d513e2
- SHA512 7c3c7c1c7d220dfa939606a9e2f0b4cff6fba07c799b90032e869c004ad42fd17a8f4343965114a405966ea5efcb5b7c3752445ee0f808dcb0a9728e8b07d4c6
- SSDEEP 196608:H7arT4R1r9BHznX7iAhREhRGhRyhRthRc:b/HNRYRyRWR/Rc
- TLSH T12096AF33F9E505EAC2BEE2B4C16297217EB174674321BB875FC445EA1A13BD0AD2D312
- MD5 SHA1 SHA512 SSDEEP TLSH