Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
22/10/2026, 20:32
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe
- Size 18.9MB
- Sample261022-zbq2vsbe33
- SHA256 1970fc28ae8d2d145412c38b4840f21eeaa7f62c9174c51dfd2b2bcf2e7c79c2
- MD5 7aa77966dfc27af47b4d2f2c7b420be2
- SHA1 91daf91a9eaacd9450c3e06f9e53488e965bfc2f
- SHA512 74834db9d3339e7e574fdd4422ff5a1b965a276d6f2e20f41a7a312c3d53e51fc41123ece5cce1533e5f180ca9be6d0840deb6da35992becee8bec97505a44ab
- SSDEEP 393216:DAkLRCR3R7R6RLRKRRRcRGRoR6RuR6R9RdR9RYRGRy:Ea
- TLSH T11717CF31B7E849AAC2BFD379D06206261EF0B827622BEB4F5E8054FD1D53BD09915363
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables referencing virtualization MAC addresses 2 IoCs
resource yara_rule behavioral1/files/0x0002000000022bb1-3.dat INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb behavioral1/files/0x000100000002219a-1314.dat INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb - Executes dropped EXE 1 IoCs
pid Process 3296 Process not Found - Loads dropped DLL 1 IoCs
pid Process 3296 Process not Found - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kkHKigLu = "c:\\Windows\\System32\\kkHKigLu.exe" 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\amL = "c:\\Windows\\System32\\amL.exe" 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bRcrWxva = "c:\\Windows\\System32\\bRcrWxva.exe" 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe - Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\desktop.ini 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created \??\c:\Windows\System32\kkHKigLu.exe 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe File created \??\c:\Windows\System32\amL.exe 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe File created \??\c:\Windows\System32\bRcrWxva.exe 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\MoviesAnywhereLogoWithTextLight.scale-200.png 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationTypes.resources.dll.exe 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\System.Web.Mvc.dll 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ClientConfiguration.dll.exe 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\GooglePromoTile.scale-100.png 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxAccountsLargeTile.scale-100.png 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-pl.xrm-ms 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Microsoft.Office.Interop.Access.dll 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNotebookWideTile.scale-150.png.exe 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\registry.png.exe 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-24_altform-unplated_contrast-white.png.exe 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Google.scale-400.png.exe 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\ExchangeSmallTile.scale-125.png 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Transactions.Local.dll.exe 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_KMS_Client_AE-ppd.xrm-ms 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AXIS\THMBNAIL.PNG 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Windows Media Player\Media Renderer\DMR_48.png 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome.exe.sig.exe 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription2-pl.xrm-ms.exe 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-ppd.xrm-ms.exe 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\codecpacks_webp.winmd 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-256_altform-unplated_contrast-high.png.exe 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Extensions.dll.exe 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordVL_MAK-pl.xrm-ms.exe 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsSplashScreen.scale-125.png.exe 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\StoreAppList.scale-200.png.exe 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\ja_FEMININE.pak 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\gstreamer.md.exe 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\ThirdPartyNotices.txt 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\CardUIBkg.scale-200.png.exe 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jfxmedia.dll.exe 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\xaml\onenote\CaptureUI.xaml 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml.exe 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\api-ms-win-crt-math-l1-1-0.dll 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libedummy_plugin.dll 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_chroma\librv32_plugin.dll.exe 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\LayersControl\ThumbAerial.png 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\cs\System.Windows.Controls.Ribbon.resources.dll 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Windows Media Player\Network Sharing\MediaReceiverRegistrar.xml 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchWide310x150Logo.scale-200_contrast-white.png 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\Example2.Diagnostics.psd1.exe 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Debug.dll 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\WindowsBase.resources.dll.exe 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-pl.xrm-ms.exe 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\strings.resjson 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-100_8wekyb3d8bbwe\images\Square44x44Logo.scale-100.png 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ppd.xrm-ms.exe 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_COL.HXC.exe 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square71x71Logo.scale-150.png 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Win10\MicrosoftSolitaireMedTile.scale-100.jpg.exe 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\TEMPSITC.TTF 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.1813.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml.exe 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MediumTile.scale-200_contrast-white.png.exe 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\kn_FEMININE.pak 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Lighting\Light\Paint3D.png 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_~_8wekyb3d8bbwe\AppxSignature.p7x 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Web.HttpUtility.dll 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\Microsoft.VisualBasic.Forms.resources.dll 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\es\System.Windows.Input.Manipulations.resources.dll 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\hr_NEUTER.pak.exe 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_output\libafile_plugin.dll.exe 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\System.ObjectModel.dll.exe 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\Doughboy.scale-250.png 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\PresentationUI.resources.dll 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-21_7aa77966dfc27af47b4d2f2c7b420be2_coinminer_glassworm_poet-rat_sliver_snatch.exe"1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
PID:620
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7-zip.dll
- Size 19.6MB
- SHA256 26771404194e2159375c5354effe6d559eaca7d5e83a06efd674200258a8a28a
- MD5 06bf083d9a4ddbc9f6b224924cf0c4e1
- SHA1 0bcaa7500f8067d73a13523e661ce8a72a9119fc
- SHA512 79333dbe981374184c19040927c8b4ee3f701396d3ad2954f0d6608b0845b286162612d7ee9e1b6948cbd7ab05c788d3c7c32337bd2c0fc16d5d5f955f361662
- SSDEEP 393216:DAkLRCR3R7R6RLRKRRRcRGRoR6RuR6R9RdR9RYRGR5RA:EU
- TLSH T1B827CF31B7E849AAC2BFD379D06206261EF0B827622BEB4F5E8054FD1D53BD09915363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
- Size 19.5MB
- SHA256 ef64be20ab856125e01c32f9453bc4a3baa933662a7f2da04a6618c21ebcb5ac
- MD5 8af1f18b9a8cb92337fa04185bad71aa
- SHA1 3d34a7e4ecc92a7429cd20dd45df131daf9b2c78
- SHA512 f75e789aaccc6dab350a7611ef9e487c8233c44f8bba6f16bcdda4efe70726e565a6f786c6f16f586a733c089f1446187d156b4dd588d86ae6181745805b8cd8
- SSDEEP 393216:DAkLRCR3R7R6RLRKRRRcRGRoR6RuR6R9RdR9RYRGR5RD:Ev
- TLSH T1DD27CF31B7E849AAC2BFD379D06206261EF0B827622BEB4F5E8054FD1D53BD09915363
- MD5 SHA1 SHA512 SSDEEP TLSH