Analysis
- max time kernel
150s - max time network
116s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/09/2026, 14:28
Behavioral task
behavioral1
Sample
2026-09-15_cc8be53ba7d1284c6f4ece26b3c932ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-15_cc8be53ba7d1284c6f4ece26b3c932ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-09-15_cc8be53ba7d1284c6f4ece26b3c932ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
- Size 9.0MB
- Sample260915-rtbe5asv9m
- SHA256 f2bc0153faf0927c2cfd7752e2319250793b7f8b71997688e7eec518324986fa
- MD5 cc8be53ba7d1284c6f4ece26b3c932ff
- SHA1 21643287bc61585d54f3ce5d41350d5d989b669d
- SHA512 5f2974a68f60c310e9e61f345fb2ff433b879cdc6ed2d26790bf63247255d009c5dd0762b7df4820560edca12d5cc5660d97d7e41d2f3c888f809ef10d5ec6bc
- SSDEEP 196608:H7arT4R1r9BHznX7iAhRqhRvhRxhR6hRZ:b/HNR+R5R7RORZ
- TLSH T11AA6AF33F9E505EAC2BEE2B4C16297217EB174674321BB875FC445EA1A13BD0AD2D312
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
gravityrat
C2
-
https://en7dftkjiipor.x.pipedream.net
Signatures
- Family: GravityRAT
GravityRAT is a cross-platform malware an Android, macOS and Windows based RAT first seen in 2015.
- Detects executables referencing virtualization MAC addresses 1 IoCs
resource yara_rule behavioral2/files/0x000400000001b226-4.dat INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb - Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-09-15_cc8be53ba7d1284c6f4ece26b3c932ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\pkcs11cryptotoken.md.exe 2026-09-15_cc8be53ba7d1284c6f4ece26b3c932ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ul-oob.xrm-ms.exe 2026-09-15_cc8be53ba7d1284c6f4ece26b3c932ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProDemoR_BypassTrial180-ppd.xrm-ms 2026-09-15_cc8be53ba7d1284c6f4ece26b3c932ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\DESIGNER\MSADDNDR.OLB.exe 2026-09-15_cc8be53ba7d1284c6f4ece26b3c932ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-pl.xrm-ms 2026-09-15_cc8be53ba7d1284c6f4ece26b3c932ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ul-oob.xrm-ms 2026-09-15_cc8be53ba7d1284c6f4ece26b3c932ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-pl.xrm-ms.exe 2026-09-15_cc8be53ba7d1284c6f4ece26b3c932ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\MINSBPROXY.DLL.exe 2026-09-15_cc8be53ba7d1284c6f4ece26b3c932ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\McePerfCtr.man 2026-09-15_cc8be53ba7d1284c6f4ece26b3c932ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN010.XML 2026-09-15_cc8be53ba7d1284c6f4ece26b3c932ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.es-es.dll.exe 2026-09-15_cc8be53ba7d1284c6f4ece26b3c932ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTest-pl.xrm-ms 2026-09-15_cc8be53ba7d1284c6f4ece26b3c932ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-ppd.xrm-ms 2026-09-15_cc8be53ba7d1284c6f4ece26b3c932ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientCapabilities.json 2026-09-15_cc8be53ba7d1284c6f4ece26b3c932ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\am.pak.exe 2026-09-15_cc8be53ba7d1284c6f4ece26b3c932ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ul-phn.xrm-ms 2026-09-15_cc8be53ba7d1284c6f4ece26b3c932ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\BIPLAT.DLL.exe 2026-09-15_cc8be53ba7d1284c6f4ece26b3c932ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LAYERS\PREVIEW.GIF.exe 2026-09-15_cc8be53ba7d1284c6f4ece26b3c932ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\7-Zip\Lang\sv.txt 2026-09-15_cc8be53ba7d1284c6f4ece26b3c932ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\jpeg.md.exe 2026-09-15_cc8be53ba7d1284c6f4ece26b3c932ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\System\ado\msador28.tlb.exe 2026-09-15_cc8be53ba7d1284c6f4ece26b3c932ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\bcel.md.exe 2026-09-15_cc8be53ba7d1284c6f4ece26b3c932ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ul-phn.xrm-ms.exe 2026-09-15_cc8be53ba7d1284c6f4ece26b3c932ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\System.Spatial.NetFX35.dll 2026-09-15_cc8be53ba7d1284c6f4ece26b3c932ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\AUTHOR.XSL.exe 2026-09-15_cc8be53ba7d1284c6f4ece26b3c932ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\index.win32.bundle.map.exe 2026-09-15_cc8be53ba7d1284c6f4ece26b3c932ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md.exe 2026-09-15_cc8be53ba7d1284c6f4ece26b3c932ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-180.png.exe 2026-09-15_cc8be53ba7d1284c6f4ece26b3c932ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\api-ms-win-core-file-l2-1-0.dll.exe 2026-09-15_cc8be53ba7d1284c6f4ece26b3c932ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\JAWTAccessBridge-64.dll 2026-09-15_cc8be53ba7d1284c6f4ece26b3c932ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-ul-oob.xrm-ms 2026-09-15_cc8be53ba7d1284c6f4ece26b3c932ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Grace-ul-oob.xrm-ms 2026-09-15_cc8be53ba7d1284c6f4ece26b3c932ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-CN\msipc.dll.mui 2026-09-15_cc8be53ba7d1284c6f4ece26b3c932ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Edit.White.png.exe 2026-09-15_cc8be53ba7d1284c6f4ece26b3c932ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LAYERS\THMBNAIL.PNG.exe 2026-09-15_cc8be53ba7d1284c6f4ece26b3c932ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Portal\PortalConnectCore.dll 2026-09-15_cc8be53ba7d1284c6f4ece26b3c932ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DatabaseServices.dll.exe 2026-09-15_cc8be53ba7d1284c6f4ece26b3c932ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Trial-pl.xrm-ms.exe 2026-09-15_cc8be53ba7d1284c6f4ece26b3c932ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Edm.NetFX35.dll.exe 2026-09-15_cc8be53ba7d1284c6f4ece26b3c932ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\hive.xsl.exe 2026-09-15_cc8be53ba7d1284c6f4ece26b3c932ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OFFREL.DLL 2026-09-15_cc8be53ba7d1284c6f4ece26b3c932ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ppd.xrm-ms.exe 2026-09-15_cc8be53ba7d1284c6f4ece26b3c932ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_KMS_Client-ppd.xrm-ms 2026-09-15_cc8be53ba7d1284c6f4ece26b3c932ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\salesforce.ini 2026-09-15_cc8be53ba7d1284c6f4ece26b3c932ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\7-Zip\7zFM.exe.exe 2026-09-15_cc8be53ba7d1284c6f4ece26b3c932ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\7-Zip\Lang\sa.txt.exe 2026-09-15_cc8be53ba7d1284c6f4ece26b3c932ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\System\Ole DB\ja-JP\sqlxmlx.rll.mui 2026-09-15_cc8be53ba7d1284c6f4ece26b3c932ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipTsf.dll.mui.exe 2026-09-15_cc8be53ba7d1284c6f4ece26b3c932ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe.exe 2026-09-15_cc8be53ba7d1284c6f4ece26b3c932ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\dom.md.exe 2026-09-15_cc8be53ba7d1284c6f4ece26b3c932ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\sbicudt58_64.dll 2026-09-15_cc8be53ba7d1284c6f4ece26b3c932ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\api-ms-win-crt-runtime-l1-1-0.dll.exe 2026-09-15_cc8be53ba7d1284c6f4ece26b3c932ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-pl.xrm-ms.exe 2026-09-15_cc8be53ba7d1284c6f4ece26b3c932ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-ul-oob.xrm-ms.exe 2026-09-15_cc8be53ba7d1284c6f4ece26b3c932ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Infragistics2.Shared.v11.1.dll.exe 2026-09-15_cc8be53ba7d1284c6f4ece26b3c932ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\en\DatabaseCompare_k_col.hxk.exe 2026-09-15_cc8be53ba7d1284c6f4ece26b3c932ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.kk-kz.dll.exe 2026-09-15_cc8be53ba7d1284c6f4ece26b3c932ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\VisualElements\SmallLogoDev.png.exe 2026-09-15_cc8be53ba7d1284c6f4ece26b3c932ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\cryptix.md 2026-09-15_cc8be53ba7d1284c6f4ece26b3c932ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-ppd.xrm-ms 2026-09-15_cc8be53ba7d1284c6f4ece26b3c932ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ppd.xrm-ms.exe 2026-09-15_cc8be53ba7d1284c6f4ece26b3c932ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ul-phn.xrm-ms 2026-09-15_cc8be53ba7d1284c6f4ece26b3c932ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPP.HTM 2026-09-15_cc8be53ba7d1284c6f4ece26b3c932ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremDemoR_BypassTrial365-ul-oob.xrm-ms.exe 2026-09-15_cc8be53ba7d1284c6f4ece26b3c932ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-15_cc8be53ba7d1284c6f4ece26b3c932ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-15_cc8be53ba7d1284c6f4ece26b3c932ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:4088
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7-zip32.dll
- Size 9.7MB
- SHA256 c5dbfadadfc322e0dd344d9bd323042230dc83a5850b0f8350ca07d0f4cc72a7
- MD5 33c5525a8c00083c00138c9e17991696
- SHA1 fb95ad77f7e21aadad2d620323f04cf76feb7552
- SHA512 9457c22e09e852421a1649839e2532fe08db8da8a942f440f165c40265732db5a10aba6788c3a3959e82fc22fa5f8b9a0fcf48aaeb4dde3b79fc0f75e343d5ad
- SSDEEP 196608:H7arT4R1r9BHznX7iAhRqhRvhRxhR6hR6hRc:b/HNR+R5R7RORORc
- TLSH T1E7A6BF33F6E505EAC2BEE2B4C06297217EB174675322B7875FC445EA1A13BD0AD2D312
- MD5 SHA1 SHA512 SSDEEP TLSH