Analysis
- max time kernel
148s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/10/2026, 17:19
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
- Size 9.7MB
- Sample261024-vvvf6sbs4x
- SHA256 1409ca16c1f4d9e67632b79886b3aaa792c1ac8946399350615d2019f0eb05f6
- MD5 3256ae193e5d5a674ccbde79e41f416c
- SHA1 0d89e6044b06d4a09c73894339c9afa366d48c0f
- SHA512 467a8137b4139124f747ba9140404aeca11c437ece7668e22113d79296a776459b133ef787a81c778fff7612ba80e6f0e6ed13d94d2217608077b77622f395d8
- SSDEEP 196608:CwAlDycg3oBbqsATtThRBhRHhRkhR1hRBhRE:Ts/cRLRBR4R3RLRE
- TLSH T1C9A6AF33F6E505EAC6BEE274C06253217EB17C674331BB875F8055B91A62BD0AE2D312
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables referencing virtualization MAC addresses 1 IoCs
resource yara_rule behavioral2/files/0x000200000001b221-3.dat INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OHHLJRS = "c:\\Windows\\System32\\OHHLJRS.exe" 2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RHJE = "c:\\Windows\\System32\\RHJE.exe" 2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\KWkUt = "c:\\Windows\\System32\\KWkUt.exe" 2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe - Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created \??\c:\Windows\System32\OHHLJRS.exe 2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created \??\c:\Windows\System32\RHJE.exe 2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created \??\c:\Windows\System32\KWkUt.exe 2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\sql70.xsl 2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_file_plugin.dll.exe 2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\InstallSuspend.pcx.exe 2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-80.png 2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL058.XML 2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\msql.xsl.exe 2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_chromaprint_plugin.dll.exe 2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Windows Defender\MpDefenderCoreService.exe.exe 2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\mesa3d.md.exe 2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-pl.xrm-ms.exe 2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-runtime-l1-1-0.dll 2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\SystemX86\msvcp140.dll.exe 2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe 2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libavcodec_plugin.dll 2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_standard_plugin.dll.exe 2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Windows Defender\MpDlpService.exe.exe 2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe.exe 2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-ppd.xrm-ms 2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.PowerBI.AdomdClient.dll.exe 2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SEQCHK10.DLL 2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\index.win32.bundle.map 2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\MySharePoints.ico 2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Microsoft.Excel.Amo.Core.dll 2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_extractor\libarchive_plugin.dll 2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.exe 2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jdk-1.8\jvisualvm.txt 2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jre-1.8\COPYRIGHT 2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jre-1.8\lib\charsets.jar.exe 2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\WordVL_KMS_Client-ul.xrm-ms 2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer2019_eula.txt 2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-80.png 2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OMICAUT.DLL 2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ink\ml-IN\tipresx.dll.mui.exe 2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-ul-phn.xrm-ms 2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OutlookAutoDiscover\YAHOO.IE.XML 2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN095.XML 2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BREEZE\BREEZE.INF.exe 2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\ONLNTCOMLIB.DLL 2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\vlc.mo.exe 2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_srt_plugin.dll 2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui.exe 2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\hu_MASCULINE.pak.exe 2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\TelemetryDashboard.xltx 2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MEDIA\TYPE.WAV 2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] 2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\CancelFluent.png.exe 2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\NIRMALAB.TTF.exe 2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\en-US_MASCULINE.pak 2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-ppd.xrm-ms 2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-ul-oob.xrm-ms 2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ul-phn.xrm-ms.exe 2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Trial-pl.xrm-ms.exe 2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_KMS_ClientC2R-ppd.xrm-ms.exe 2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicelegant.dotx.exe 2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OutlookAutoDiscover\YAHOO.SE.XML 2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui 2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml 2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\IwaKeyDistribution\iwa-key-distribution.pb 2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.Diagnostics.dll 2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\DUBAI-MEDIUM.TTF.exe 2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\vcruntime140.dll.exe 2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\COMPASS\THMBNAIL.PNG.exe 2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\MSOIDCLIL.DLL 2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_3256ae193e5d5a674ccbde79e41f416c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe"1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
PID:5412
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:704
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7-zip.dll
- Size 10.4MB
- SHA256 15ca6cca473c04689bf88caa78a7371e1cee6c317f1cfab181331e1b901a439b
- MD5 9443e4a4d47f2ff638e6a4479e2d01b5
- SHA1 ceb4d9c4f1aedf462626b25117eb77b39c3da5c3
- SHA512 e1423472620e84f06e5c21f94502ce1b424f5222893d18d4198ff31777c965815cb0ad0522977d162fc67a87bfc30a9197554271f473cbdd98111a02b03276f5
- SSDEEP 196608:CwAlDycg3oBbqsATtThRBhRHhRkhR1hRBhR1hRd:Ts/cRLRBR4R3RLR3Rd
- TLSH T10AB6AF32F6E505EAC6BEE274C06253217EB17C574332BB8B5F8055B91A63BD0AD2D312
- MD5 SHA1 SHA512 SSDEEP TLSH