Analysis
- max time kernel
149s - max time network
136s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
06/10/2026, 16:36
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
- Size 9.3MB
- Sample261006-t4eawaff23
- SHA256 4e22234cd19e81f32fd829ccb292c5fbb8b4d0e4dc18fa20716366afae5493f8
- MD5 b56ae4fe003cc92cf69938e5116ab728
- SHA1 f8bd747c39b8077b168c44bd7b63a1a0a3dba53e
- SHA512 b51344687fdb7919f2798b7fe3ae1307e57764f37f8e0d8ea65897c879a072f4226373947fe97ef9acdd96c04e44985f576ce62a79e9112e77f5f1a0b59e2a72
- SSDEEP 196608:mbDkZphgT73KxRyfCfShR7hRihR0hR6hRD:wABcRNRGRIRORD
- TLSH T19CA69E32FAE514EAC2BFE174C16257217EB2747B4331BB875F8049A91A12FD0AD2D352
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables referencing virtualization MAC addresses 1 IoCs
resource yara_rule behavioral1/files/0x0002000000022b90-3.dat INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nXA = "c:\\Windows\\System32\\nXA.exe" 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ev = "c:\\Windows\\System32\\Ev.exe" 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wCR = "c:\\Windows\\System32\\wCR.exe" 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe - Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\desktop.ini 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created \??\c:\Windows\System32\wCR.exe 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created \??\c:\Windows\System32\nXA.exe 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created \??\c:\Windows\System32\Ev.exe 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-pl.xrm-ms 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-20_altform-unplated_contrast-black.png 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\NavigationIcons\nav_icons_store.targetsize-48.png 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\Microsoft.VisualBasic.Forms.resources.dll.exe 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CAPSULES\PREVIEW.GIF.exe 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\PresentationBuildTasks.resources.dll 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\igxim.dll 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ja\System.Xaml.resources.dll.exe 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ul.xrm-ms.exe 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\api-ms-win-core-file-l1-2-0.dll.exe 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Runtime.Extensions.dll.exe 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.NET.Native.Framework.2.2_2.2.27405.0_x64__8wekyb3d8bbwe\SharedLibrary.dll.exe 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-48_contrast-white.png 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\OUTLWVW.DLL 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL105.XML 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Json.dll.exe 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\ALRTINTL.DLL.exe 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\MsoAriaImm.dll.exe 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionMedTile.scale-125.png.exe 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailSmallTile.scale-100.png.exe 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\LargeTile.scale-125_contrast-black.png 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraSplashScreen.contrast-white_scale-200.png 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-16_altform-lightunplated.png 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\PresentationCore.resources.dll 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\zlib.md.exe 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LEVEL\LEVEL.ELM.exe 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\System.Collections.NonGeneric.dll.exe 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-pl.xrm-ms.exe 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_KMS_Client-ul.xrm-ms.exe 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.RunTime.Serialization.Resources.dll.exe 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteAppList.targetsize-16_altform-unplated.png 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosLogoExtensions.targetsize-48.png.exe 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\lv_NEUTER.pak 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ul-phn.xrm-ms 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-pl.xrm-ms 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libcdda_plugin.dll 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Assets\tinytile.targetsize-256_contrast-white.png 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\af-ZA\View3d\3DViewerProductDescription-universal.xml.exe 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\contrast-white\MixedRealityPortalAppList.targetsize-72_altform-unplated_contrast-white.png 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Drawing.Design.dll.exe 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\d3d11\libdirect3d11_filters_plugin.dll 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\FileExtension.targetsize-32.png.exe 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ko\UIAutomationClientSideProviders.resources.dll 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Marquee.xml 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Exchange.WebServices.dll 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\WideLogo.scale-125_contrast-white.png 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-16_contrast-white.png.exe 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\SplashScreen.scale-100_contrast-black.png.exe 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationTypes.resources.dll 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\msjet.xsl 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraMedTile.contrast-black_scale-200.png 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\SplashScreen.scale-125_contrast-black.png 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-white\LargeTile.scale-200.png.exe 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationFramework.resources.dll 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.ServiceModel.Resources.dll 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Win10\MicrosoftSolitaireAppList.targetsize-96_altform-unplated_devicefamily-colorfulunplated.png 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\MarkAsReadToastQuickAction.scale-80.png 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Square150x150\PaintMedTile.scale-100.png.exe 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\animations\OneNoteFirstRunCarousel_Animation1.mp4.exe 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.targetsize-72_altform-unplated.png.exe 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jdk-1.8\include\jawt.h 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-05_b56ae4fe003cc92cf69938e5116ab728_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe"1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
PID:2648
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7-zip.dll
- Size 10.0MB
- SHA256 169e8b95e1a08817b8538cd9e9ef50aee35130f41e0e84da7cdcaf70afc56749
- MD5 7542e406c3163714e166b3487330fd9d
- SHA1 6c861cb990cee51e29d13c4adcd1cc92e606ef15
- SHA512 83df958e058e61b4d801734945b772da4e99bc5ee9bda2ee591ba2091ecbd467c22079b20dfd99a81ee773d74f839c9df7559583648dc4d44561c61576208b62
- SSDEEP 196608:mbDkZphgT73KxRyfCfShR7hRihR0hR6hRAhRE:wABcRNRGRIROR8RE
- TLSH T1DCB69E32FAE514EAC2BFE274C16257217EB274774331BB875F8049A91A12FD0AD2D352
- MD5 SHA1 SHA512 SSDEEP TLSH