Analysis
- max time kernel
148s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 04:35
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
- Size 13.7MB
- Sample260930-e7p48axerb
- SHA256 4e4a2bf0ecf3213d406260b49a5c43840cec3f37b50a7fcf1a0b5b1fb9be0ee8
- MD5 1fb4a360d2c332ba72774087a4518d11
- SHA1 512a83241390cdf5dfc80c067b07b088b0e1effd
- SHA512 1f354a410d90d27311fbfad0f9e86c7297e3ba87b5f5abf6cd16bf5e9d308efeb144efb86f4caf2875599f49a54a8a63291e180c39afce34727e32bf0f0b6701
- SSDEEP 196608:CwAlDycg3oBbqsATtThRBhRHhRkhRqhRDhRAhRrhRRhREhRNhRU:Ts/cRLRBR4R+RlR8R9RbRYRfRU
- TLSH T1D0E6BF22B7E449AEC2FFD274D06206217EB1B8675326EB8B5F8045F91D63BD0AD19313
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables referencing virtualization MAC addresses 1 IoCs
resource yara_rule behavioral2/files/0x000d00000001c545-4.dat INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IfbhR = "c:\\Windows\\System32\\IfbhR.exe" 2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HSekWnj = "c:\\Windows\\System32\\HSekWnj.exe" 2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\c = "c:\\Windows\\System32\\c.exe" 2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe - Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created \??\c:\Windows\System32\HSekWnj.exe 2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created \??\c:\Windows\System32\c.exe 2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created \??\c:\Windows\System32\IfbhR.exe 2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\en-us\oregres.dll.mui 2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\1033\OCLTINT.DLL 2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\FrameworkList.xml 2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_h264_plugin.dll 2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libcache_block_plugin.dll 2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\System\msadc\adcjavas.inc 2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ppd.xrm-ms.exe 2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_KMS_Client-ul-oob.xrm-ms 2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\csi.dll 2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] 2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Services.Client.resources.dll 2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\plugins\text_renderer\libsapi_plugin.dll.exe 2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaSansRegular.ttf.exe 2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\SIGN.CFG.exe 2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-warning.png 2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\tt\LC_MESSAGES\vlc.mo 2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_logo_small.png 2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\msmgdsrv.dll 2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.RunTime.Serialization.Resources.dll.exe 2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ink\pl-PL\tipresx.dll.mui 2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\prism_sw.dll 2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-pl.xrm-ms.exe 2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Grace-ul-oob.xrm-ms.exe 2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\es\msipc.dll.mui.exe 2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jfxwebkit.dll.exe 2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\zlib.md.exe 2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml 2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Grace-ppd.xrm-ms.exe 2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial2-ppd.xrm-ms 2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-ul-oob.xrm-ms.exe 2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_Subscription-pl.xrm-ms.exe 2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OutlookLogo.scale-100.png.exe 2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\es-419_MASCULINE.pak 2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-black_scale-80.png.exe 2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\WHOOSH.WAV.exe 2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-file-l1-2-0.dll 2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\LEELAWDB.TTF 2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Mozilla Firefox\wmfclearkey.dll 2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Services.resources.dll.exe 2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\vlc.mo.exe 2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL106.XML.exe 2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Resources\1033\msolui.rll.exe 2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.ServiceModel.Resources.dll.exe 2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\vlc.mo 2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\cue.luac 2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\plugins\gui\libskins2_plugin.dll.exe 2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InkObj.dll.mui.exe 2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\sound.properties.exe 2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-ppd.xrm-ms.exe 2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-pl.xrm-ms.exe 2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\Custom.propdesc.exe 2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\libcurl.dll.exe 2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ACEODATA.DLL.exe 2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PROFILE\PROFILE.INF.exe 2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Grace-ppd.xrm-ms.exe 2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-pl.xrm-ms.exe 2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\msvcp120.dll.exe 2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vreg\excel.x-none.msi.16.x-none.vreg.dat.exe 2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\vlc.mo 2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libdolby_surround_decoder_plugin.dll.exe 2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jfxmedia.dll.exe 2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\EssentialResume.dotx 2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Windows Defender\ClientWMIInstall.mof 2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui.exe 2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_1fb4a360d2c332ba72774087a4518d11_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe"1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
PID:1472
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7-zip.dll.exe
- Size 14.4MB
- SHA256 746fc4e32bded92061fc8378e27c8c573644df7c373e7f604e0ff51e4454bab8
- MD5 aed14d2939dd8ad5ad1d0a614cb98994
- SHA1 96708c970f910d2f3b483fd85c8c1b2eb58074bd
- SHA512 f297d71a1deccee9674562237c18415aa0ecd5e4b4494630da1264d61200ca9879ca32f6d2b6c154057325f786a9fc89b462fd20a2d8f9b6f4bcbddeca02652b
- SSDEEP 196608:CwAlDycg3oBbqsATtThRBhRHhRkhRqhRDhRAhRrhRRhREhRNhRlhRT:Ts/cRLRBR4R+RlR8R9RbRYRfRnRT
- TLSH T1CCE6CF22B7E449AEC2FFD275D06206213EB1B8675326EB8B5F8045F91D53BD0AD19323
- MD5 SHA1 SHA512 SSDEEP TLSH