Analysis
- max time kernel
149s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/11/2026, 10:17
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe
- Size 15.1MB
- Sample261102-mble6aa19q
- SHA256 542cbc594ae2fdfdc139a4d11d0beb8a4e7456c46d83a29aa7cc5a22e73c874c
- MD5 bc0053913ffaab0e45254fc48b9237cb
- SHA1 9e60bb37a115ab30322cd13288074896e14ac613
- SHA512 f2d5436772cc9bc4259dc91070be5bd7516b97075f71fb09903616b93ccb8383026acc73aed5ffbd9272b72cf77b80a897ef02930dd7817e977686d0912550cb
- SSDEEP 196608:CwAlDycg3oBbqsATtThRBhRnhRchRihRbhRYhRuhRRhRPhR9hRHhRWhRz:Ts/cRLRhRARGRtRkRKRbRZRPRBRCRz
- TLSH T1ABF6C022B7E849AEC2FFD375D06206212EF1B8675326EB8B5E8045F91D53BD09D19323
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables referencing virtualization MAC addresses 1 IoCs
resource yara_rule behavioral1/files/0x0002000000022be4-3.dat INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fRCA = "c:\\Windows\\System32\\fRCA.exe" 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\LkM = "c:\\Windows\\System32\\LkM.exe" 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Et = "c:\\Windows\\System32\\Et.exe" 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe - Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\desktop.ini 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created \??\c:\Windows\System32\LkM.exe 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe File created \??\c:\Windows\System32\Et.exe 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe File created \??\c:\Windows\System32\fRCA.exe 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Store.Purchase\Controls\ErrorControl.xaml.exe 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProMSDNR_Retail-ul-oob.xrm-ms.exe 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\accessibilitychecker\main.js.exe 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\en-gb\locimages\offsymxl.ttf.exe 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarSplashLogo.scale-125.png.exe 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\lua\http\requests\browse.xml.exe 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\LargeTile.scale-125_contrast-white.png.exe 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\EmptySearch-Dark.scale-400.png.exe 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\RSSITEMS.ICO.exe 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OutlookLogoSmall.contrast-white_scale-80.png.exe 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\28.png 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-24_altform-unplated.png 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\WindowsPhoneReservedAppInfo.xml.exe 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Principal.Windows.dll.exe 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\ko.pak.exe 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_Subscription-ul-oob.xrm-ms 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.DynamicData.dll 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-80.png.exe 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxComm.Ipc.Proxies.dll.exe 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Images\thumb_stats_render.png 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteWideTile.scale-150.png.exe 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\offsyml.ttf 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\models\en-GB.PostalAddress.model.exe 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\BeGreaterThan.Tests.ps1 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\AppList.scale-125_contrast-black.png 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\th_NEUTER.pak 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe.exe 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\155.png.exe 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\SolitaireLiveTileUpdater.winmd.exe 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionSmallTile.scale-200.png.exe 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\onboarding\contacts_permission_android.gif 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\notification.send.png.exe 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\170.png.exe 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.targetsize-256_contrast-black.png.exe 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Lighting\Light\CottonCandy.png.exe 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-32.png 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Yahoo-Dark.scale-150.png.exe 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationClientSideProviders.resources.dll 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Windows Media Player\en-US\wmpnscfg.exe.mui 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\npdeployJava1.dll 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_fr.properties.exe 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\hive.xsl 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSplashLogo.scale-150.png.exe 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\TimerSmallTile.contrast-black_scale-200.png 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-72_altform-unplated_contrast-white.png.exe 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\Assets\GameBar_WideTile.scale-200.png.exe 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\EXITEML.ICO.exe 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial4-ppd.xrm-ms 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_2019.125.2243.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Toolkit\Images\dash.png.exe 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.HttpListener.dll 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\Spotlight_NFL.png.exe 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemDrawing.dll.exe 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\PresentationFramework-SystemCore.dll.exe 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\locale\ro\LC_MESSAGES\vlc.mo.exe 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.targetsize-20_altform-unplated_contrast-black.png 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-36_altform-unplated.png.exe 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial-ul-oob.xrm-ms.exe 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.NET.Native.Framework.2.2_2.2.27405.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.InteropServices.dll 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ul-phn.xrm-ms.exe 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-01_bc0053913ffaab0e45254fc48b9237cb_coinminer_glassworm_poet-rat_sliver_snatch.exe"1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
PID:1756
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7-zip.dll
- Size 15.7MB
- SHA256 945c925a407b65a1ebe4a610d999c7f62c02dfd7ae783bfbcb7c2dd0fa90cdcd
- MD5 27f3a684708d99b091d8497c15d776a3
- SHA1 1b7082e1ee7f38f36fd8ed36da23bf2b11f4d8c1
- SHA512 0ec9efe71b5ff7a69c76182c74bd830e809d4c98707df023d3620d37d755338ba7e3f97d3ae9150cd83657d3d79f79ee320b77029568ddf110919601182feeb8
- SSDEEP 196608:CwAlDycg3oBbqsATtThRBhRnhRchRihRbhRYhRuhRRhRPhR9hRHhRWhRQhRx:Ts/cRLRhRARGRtRkRKRbRZRPRBRCRMRx
- TLSH T181F6C022B7E849AEC2FFD375D06206212EF1B8675326EB8F5E8045F91D53BD09919323
- MD5 SHA1 SHA512 SSDEEP TLSH