Analysis
- max time kernel
148s - max time network
27s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/10/2026, 16:57
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe
- Size 18.3MB
- Sample261014-vf8egsf14v
- SHA256 0eac3ad0d91f43f35e03ceecc080558abb324a209dba0dafa2bb8cffaaa57059
- MD5 8e4e4454d38b5b39c4553ec6ced4e1a9
- SHA1 9e896df5f94c1eb3fd4bed2c0f7fd1c474a26083
- SHA512 91feba34c248467fdd70ba6dbc3b4d0637b69c077ef87ccd3b6a375ddf8d96328c167e339da91ec6ca4a589401aff26e9e7d3a4578743f8518855b67d65cc5e5
- SSDEEP 393216:DAkLRCR3R7R6RLRKRRRcRGRoRRRGRdR1RrR4ReRn:ER
- TLSH T11E17C031B7E849AAC2BFD379D06206262EF0B8276326EB4F5E8054FD1D53BD09915363
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables referencing virtualization MAC addresses 1 IoCs
resource yara_rule behavioral2/files/0x0003000000006945-3.dat INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VycZg = "c:\\Windows\\System32\\VycZg.exe" 2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kKj = "c:\\Windows\\System32\\kKj.exe" 2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TEHnnx = "c:\\Windows\\System32\\TEHnnx.exe" 2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe - Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created \??\c:\Windows\System32\VycZg.exe 2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe File created \??\c:\Windows\System32\kKj.exe 2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe File created \??\c:\Windows\System32\TEHnnx.exe 2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libsimple_channel_mixer_plugin.dll.exe 2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui 2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_Subscription-ppd.xrm-ms 2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Edm.NetFX35.V7.dll 2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-100.png.exe 2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN020.XML 2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\lt_FEMININE.pak.exe 2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-processthreads-l1-1-0.dll.exe 2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\ecc.md.exe 2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\jcup.md.exe 2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ul-oob.xrm-ms 2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-ppd.xrm-ms 2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BOLDSTRI\BOLDSTRI.ELM 2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\7-Zip\Lang\en.ttt 2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCalls.c.exe 2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.SapBwProvider.dll 2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLMAPI32.DLL 2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WindowsFormsIntegration.dll.exe 2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\vlc.mo 2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\th_MASCULINE.pak 2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngom.md 2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONLNTCOMLIB.DLL 2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLRPC.DLL 2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL087.XML 2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\vcruntime140.dll.exe 2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STUDIO\STUDIO.ELM 2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\OWSCLT.DLL.exe 2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkDrop32x32.gif 2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jdk-1.8\lib\jawt.lib 2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Common.v4.0.Utilities.dll 2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\OUTLVBA.DLL 2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-140.png.exe 2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\SCNPST32.DLL.exe 2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\ANTQUABI.TTF.exe 2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\as80.xsl 2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOLoaderUI.dll 2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml 2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\bn_NEUTER.pak.exe 2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\lt.pak 2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusDemoR_BypassTrial365-ul-oob.xrm-ms 2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.Recommendation.Client.Core.dll 2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EDGE\EDGE.ELM 2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jdk-1.8\lib\ant-javafx.jar 2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTest-ul-oob.xrm-ms 2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\OriginReport.Dotx.exe 2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\api-ms-win-crt-utility-l1-1-0.dll 2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\IRIS\IRIS.ELM 2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SONORA\SONORA.INF 2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vreg\proofing.msi.16.en-us.vreg.dat.exe 2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md 2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_COL.HXC.exe 2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\vlc.mo 2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\mecontrol.png 2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHEV.DLL.exe 2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\liba52_plugin.dll.exe 2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremDemoR_BypassTrial365-ppd.xrm-ms.exe 2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RIPPLE\PREVIEW.GIF 2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui 2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\msvcp140.dll 2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Franklin Gothic.xml 2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest5-ul-oob.xrm-ms 2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-14_8e4e4454d38b5b39c4553ec6ced4e1a9_coinminer_glassworm_poet-rat_sliver_snatch.exe"1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
PID:4904
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7-zip.dll
- Size 19.0MB
- SHA256 4fa64426cf76893c47f4f8788cfcb5222e665709292b3c6093c6483deb33de49
- MD5 67916d75932f5f0e53cdda53a9f8c91e
- SHA1 a8662af54ab1b60c207820ec6e7737a1aa3ea54d
- SHA512 95b4010771f9c2f6a3b951073932eb02cfa89c5c4dc66a2ab8a4975a9d8d2ba56e7dfa6c5652ba8587eeccabebfb9c0a401c09ec9efac4805952db9b353635ef
- SSDEEP 393216:DAkLRCR3R7R6RLRKRRRcRGRoRRRGRdR1RrR4ReRYR4:Ex
- TLSH T1E817C031B7E849AAC2BFD379D06206261EF0B827622BEB4F5E8054FD1D53BD09915363
- MD5 SHA1 SHA512 SSDEEP TLSH