Analysis
- max time kernel
149s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
15/04/2026, 22:41
Behavioral task
behavioral1
Sample
2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
- Size 9.2MB
- Sample260415-2mkqbsdx4x
- SHA256 889e84f7808273855aa97ff7f9b895494c963e39cfa6ecc2cebe7a824278c9ce
- MD5 ee08afb7a68f6acd22472503d2e30f15
- SHA1 69f1ea5a14fb728434ce9c2892692279c58bb8b6
- SHA512 2ea6e8bd318bbc8f9cfb3cbd7c11e40f5cfdabf3ff0523fbd2ef2f8bde3967a7138b75f0392e08acc66d4b6e11eca7f99bb066fe680aa4d2a98badd12aa7aa09
- SSDEEP 98304:lhpBinjOykGcPdOR5NTIOSAkdvjozRH3DgdBU8:TpAnjOyAdOrNTfgd7ozN3cdBU8
- TLSH T154A67C16B3E44237E0B7917AC0B25B69EA71346A5B31C3CF3244B65E1E637D28937722
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Custom signatureDetects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral1/files/0x00130000000242a9-5.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Custom signatureDetects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral1/files/0x00130000000242a9-5.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Custom signatureUPX dump on OEP (original entry point) 1 IoCs
resource yara_rule behavioral1/files/0x00130000000242a9-5.dat UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\backgroundTaskHost.exe 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\dplaysvr.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\logagent.exe 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\msinfo32.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\mstsc.exe 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\winrshost.exe 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\bitsadmin.exe 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\hdwwiz.exe 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\nslookup.exe 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\winver.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\fontdrvhost.exe 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cacls.exe 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\netbtugc.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\odbcad32.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\reg.exe 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\RMActivate_ssp_isv.exe 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\timeout.exe 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\winrs.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\xcopy.exe 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\prevhost.exe 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\sdbinst.exe 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\sdchange.exe 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\tasklist.exe 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wowreg32.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\find.exe 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\fixmapi.exe 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\mobsync.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\printui.exe 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ddodiag.exe 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\dialer.exe 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\newdev.exe 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\runas.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\setup16.exe 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\explorer.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\getmac.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\logman.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\mstsc.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\NETSTAT.EXE- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\rasphone.exe 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\regsvr32.exe 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\TpmInit.exe 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\rekeywiz.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cmdl32.exe 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\iscsicpl.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\quickassist.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SecEdit.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\doskey.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\doskey.exe 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe -
resource yara_rule behavioral1/memory/2908-0-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/files/0x00130000000242a9-5.dat upx behavioral1/memory/2908-716-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/2908-717-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/2908-1413-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/2908-2002-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/2908-2743-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/2908-3198-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/2908-3199-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/2908-3203-0x0000000000400000-0x000000000040F000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre-1.8\bin\javaws.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Media Player\setup_wm.exe 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Mozilla Firefox\updater.exe 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\show_third_party_software_licenses.bat 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Windows Mail\wabmig.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Mozilla Firefox\firefox.exe 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Internet Explorer\ielowutil.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Internet Explorer\ielowutil.exe 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-warp-jitexecutable_31bf3856ad364e35_10.0.19041.1_none_8dffc6a8f5e8b160\Windows.WARP.JITService.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..essagingcoreservice_31bf3856ad364e35_10.0.19041.1_none_98fad53f878bc04c\mqbkup.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.19041.746_none_7a0308f7ffc334d5\resmon.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.19041.1081_none_f28ba6a10743aebc\SpeechModelDownload.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-setup-support_31bf3856ad364e35_11.0.19041.1081_none_7e66aef13d0cb227\ie4uinit.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..essagingcoreservice_31bf3856ad364e35_10.0.19041.1_none_98fad53f878bc04c\mqsvc.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..eak-diagnostic-core_31bf3856ad364e35_10.0.19041.1_none_1102b0871cbfcf0b\rdrleakdiag.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-srdelayed_31bf3856ad364e35_10.0.19041.1_none_0c4e6556fb852148\srdelayed.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-control_31bf3856ad364e35_10.0.19041.423_none_81cc87a43da05fd1\control.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.1_none_216932a6d29366ce\diskperf.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\r\AppVNice.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-thumbexthost_31bf3856ad364e35_10.0.19041.746_none_d8baedf8d09aba05\f\ThumbnailExtractionHost.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_hyperv-commandline-tool_31bf3856ad364e35_10.0.19041.928_none_0b17415ae0dd0379\r\hvc.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-ngc-trustlet_31bf3856ad364e35_10.0.19041.84_none_dd81fb99bc3b1e53\NgcIso.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..appserver-licensing_31bf3856ad364e35_10.0.19041.1_none_5ca728f7dabaeefb\tlsbln.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..nputpersonalization_31bf3856ad364e35_10.0.19041.746_none_1da55dc225237a0d\InputPersonalization.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..cation-creduibroker_31bf3856ad364e35_10.0.19041.1_none_80ac2d61ac960bf3\CredentialUIBroker.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager_31bf3856ad364e35_10.0.19041.84_none_ffbdc333a0778274\f\hvsimgr.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-provisioning-platform_31bf3856ad364e35_10.0.19041.844_none_487fcc4fe2c3cfbb\provlaunch.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..sktop.appxmain.root_31bf3856ad364e35_10.0.19041.264_none_a71c9f7fdcd899c5\f\SearchApp.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-klist_31bf3856ad364e35_10.0.19041.1266_none_b5fa73367bbd2f91\r\klist.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.1081_none_2e31e8eed4b770c3\r\WMIADAP.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-atbroker_31bf3856ad364e35_10.0.19041.1_none_8fe667a6f213806a\AtBroker.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-s..chservice-component_31bf3856ad364e35_10.0.19041.1266_none_2262e67641106c48\r\SpeechRuntime.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.19041.746_none_7c508e4438cec899\phoneactivate.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_wcf-comsvcconfig_b03f5f7f11d50a3a_10.0.19041.1_none_3f67a7384812df13\ComSvcConfig.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-filtermanager-utils_31bf3856ad364e35_10.0.19041.546_none_01dba454b887ba53\fltMC.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\msil_addinutil_b77a5c561934e089_10.0.19041.1_none_724c73dbde296e25\AddInUtil.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.1_none_216932a6d29366ce\typeperf.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-coresystem-wpr_31bf3856ad364e35_10.0.19041.746_none_4028b8f4f6c0b829\r\wpr.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tabletpc-inputpanel_31bf3856ad364e35_10.0.19041.844_none_ef8661e4d6535c5c\f\TabTip.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\AddInUtil.exe 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..screencontentserver_31bf3856ad364e35_10.0.19041.746_none_e540b68b09558f5a\r\LockScreenContentServer.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_10.0.19041.746_none_d22800313aa7eb5c\r\regedit.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-upnpdevicehost_31bf3856ad364e35_10.0.19041.867_none_aa218bebc7c352ef\r\upnpcont.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.19041.264_none_1477a882bdce0df2\vmms.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..onment-core-tcbboot_31bf3856ad364e35_10.0.19041.1288_none_75442af2fe19577c\tcblaunch.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dpiscaling_31bf3856ad364e35_10.0.19041.1_none_3038e0b9fa4d9cdf\DpiScaling.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.19041.1_none_9fbebf8222c20a6d\uwfux.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tabletpc-inputpanel_31bf3856ad364e35_10.0.19041.844_none_ef8661e4d6535c5c\TabTip.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-winrsplugins_31bf3856ad364e35_10.0.19041.1_none_d67c2e3d05659825\winrshost.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1288_none_71734bf99a2a6955\Microsoft.Uev.CscUnpinTool.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-dsdbutil_31bf3856ad364e35_10.0.19041.844_none_1d907c422e447b14\f\dsdbutil.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msconfig-exe_31bf3856ad364e35_10.0.19041.1110_none_4f46693352ed3250\r\msconfig.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-openwith_31bf3856ad364e35_10.0.19041.746_none_4b1a1978d1832a5f\f\OpenWith.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-uso-dtuhandler_31bf3856ad364e35_10.0.19041.153_none_c0c4ee134c2535a0\r\DTUHandler.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.1_none_c513167c1d0a90dd\icsunattend.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..-management-console_31bf3856ad364e35_10.0.19041.1_none_c564589414ffc535\mmc.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-proximityuxhost_31bf3856ad364e35_10.0.19041.746_none_72f50b15ab3c2aeb\ProximityUxHost.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_netfx35cdf-csd_cdf_installer_31bf3856ad364e35_10.0.19041.1_none_0e4d25c8cb52f8d0\WFServicesReg.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..tegrity-diagnostics_31bf3856ad364e35_10.0.19041.985_none_4a26c2c5164ad5c7\r\CIDiag.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-cttune_31bf3856ad364e35_10.0.19041.1_none_73ca4447924360c1\cttune.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-extcom_31bf3856ad364e35_10.0.19041.1202_none_7f995fddf54c000c\SppExtComObj.Exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_ef0e010d1381269b\f\aspnetca.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..nt-enrollmenthelper_31bf3856ad364e35_10.0.19041.746_none_18c3ddf7dbfedda0\r\PinEnrollmentBroker.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-webauth_31bf3856ad364e35_10.0.19041.1_none_e1940364964a9f22\AuthHost.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-telnet-client_31bf3856ad364e35_10.0.19041.1_none_6e229ee8c467f101\telnet.exe- 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-15_ee08afb7a68f6acd22472503d2e30f15_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2908
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 9.8MB
- SHA256 41ef95826acc41c1afa1390dc47def4057b7fe39d2adb1c2631fbd55e7d42063
- MD5 2181c21fc8161fcb24f762b50be27789
- SHA1 6ceb75676fa55ece4fe96580e6f6c607e8fda737
- SHA512 67cc9fcc54692844a743ee335c648292c0c2ee1ca12ae378451439335e2562d526e179d0c5c516fb5b523ae6e278ec3989ea9bc89a9484b7e1c7bbc593cfd2f9
- SSDEEP 98304:lhpBinjOykGcPdOR5NTIOSAkdvjozRH3DgdBU8jog:TpAnjOyAdOrNTfgd7ozN3cdBU2og
- TLSH T1AFA68C16B3A44237E0B7917AC0B25B59EA71346A5B31C3CF3244B66D2E637D28937732
- MD5 SHA1 SHA512 SSDEEP TLSH