5720fc55c493ff4f67f682014f236b18579f1b951c25a70ec9da47c5b8185c0f

Analysis

max time kernel
148s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/11/2026, 22:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
Size 10.4MB
Sample261101-2b72gsfv8m
SHA256 5720fc55c493ff4f67f682014f236b18579f1b951c25a70ec9da47c5b8185c0f
MD5 9b98c560a4b72858f4289d003f400d71
SHA1 a9cb38bd173170ff1513be680bd0e0ba35bd480b
SHA512 55c3c774061f87cd1b81879e6901307bc79c082cbfc2a8a0cd722f420f29257b9a25d8e82eabaac0f87c066de847fe2623fd7cf2adc1e234052f929682a3210a
SSDEEP 196608:2wAlDycg3oBbqsATtThRBhRHhRkhR1hRThRFhRN:/s/cRLRBR4R3R1RHRN
TLSH
T1BFB6AF32F6E505EAC6BEE274C06253217EB17C574332BB8B5F8055B91A63BD0AD2D312
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence

Malware Config

Signatures

Custom signature

Detects executables referencing virtualization MAC addresses 1 IoCs

resource	yara_rule
behavioral2/files/0x000200000001b2c4-3.dat	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\n = "c:\\Windows\\System32\\n.exe"	2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "c:\\Windows\\System32\\.exe"	2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pTQCqmgsY = "c:\\Windows\\System32\\pTQCqmgsY.exe"	2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\n.exe	2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
File created	\??\c:\Windows\System32\.exe	2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
File created	\??\c:\Windows\System32\pTQCqmgsY.exe	2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-ul-oob.xrm-ms	2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ppd.xrm-ms.exe	2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL.HXS	2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\UmOutlookStrings.dll	2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MINSBPROXY.DLL.exe	2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CONCRETE\CONCRETE.INF	2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.VisualElementsManifest.xml	2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\VisualElements\SmallLogoDev.png.exe	2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-interlocked-l1-1-0.dll	2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xmlresolver.md.exe	2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\jdk\libpng.md	2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Grace-ppd.xrm-ms	2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ul.xrm-ms.exe	2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ul-phn.xrm-ms.exe	2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-pl.xrm-ms	2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msaddsr.dll.mui	2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\fontconfig.properties.src	2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GKPowerPoint.dll	2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-180.png	2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MEDIA\SUCTION.WAV	2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ja\msipc.dll.mui	2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Microsoft Office\root\vfs\System\msvcp140_1.dll.exe	2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libvhs_plugin.dll	2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
File created	C:\Program Files\7-Zip\Lang\pl.txt.exe	2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ppd.xrm-ms.exe	2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OART.DLL	2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libogg_plugin.dll	2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
File created	C:\Program Files\VideoLAN\VLC\skins\fonts\FreeSans.ttf.exe	2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-process-l1-1-0.dll.exe	2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ppd.xrm-ms	2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-pl.xrm-ms	2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\MSB1CACH.LEX	2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\vlc.mo	2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libx264_plugin.dll.exe	2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_de.properties.exe	2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.VisualBasic.Targets	2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-ul-phn.xrm-ms	2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\TellMeOutlookAppt.nrr.exe	2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sk\msipc.dll.mui.exe	2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libmagnify_plugin.dll.exe	2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml	2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ppd.xrm-ms.exe	2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-100.png.exe	2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\GOTHICBI.TTF.exe	2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\PROOF\MSWDS_ES.LEX	2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\libsatip_plugin.dll	2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Windows Defender\it-IT\EppManifest.dll.mui	2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\public_suffix_list.dat.exe	2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-100.png	2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-140.png	2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_imem_plugin.dll.exe	2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Common Files\System\ado\msado20.tlb.exe	2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaws.exe.exe	2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-ul-phn.xrm-ms	2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\RCLRPT.CFG	2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ms\msipc.dll.mui	2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationClient.resources.dll	2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\lv_MASCULINE.pak.exe	2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-ppd.xrm-ms	2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-80.png.exe	2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
File opened for modification	C:\Program Files\Mozilla Firefox\precomplete	2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jsoundds.dll.exe	2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-pl.xrm-ms	2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-31_9b98c560a4b72858f4289d003f400d71_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe"
1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
PID:4676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7-zip.dll

Path C:\Program Files\7-Zip\7-zip.dll
Size 11.1MB
SHA256 11ceb455803624667cf0d520674a4efc2702d36ccccf8e34ca07f2e2d1ecabbb
MD5 63d8679afca308ef6b3534a74c0684d5
SHA1 eeb6ac41da1079c37d3fdb23ce5adbc0b0dd08e7
SHA512 dfdb9f65b1d2332a1c082121143a32319a279e201006af3d24515867a0c1795fed9c73337ceb3345cadcd9193df9fe05a2e28db23dd94da7501ad01876d6df72
SSDEEP 196608:2wAlDycg3oBbqsATtThRBhRHhRkhR1hRThRFhR+hRP:/s/cRLRBR4R3R1RHRaRP
TLSH
T1B7C6BF32F6E505AAC2BEE274C06252217EB1B8574336FB8B5F8055F91D63BD0AD2D312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads