Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
15/04/2026, 23:21
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe
Resource
win11-20260130-en
windows11-21h2-x64
5 signatures
150 seconds
General
- Target 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe
- Size 13.2MB
- Sample260415-3b3mfaes2y
- SHA256 46ebb542b2d7ea36e9ef1be4cafc8e6545ac0f2e524f8fd1e6c7677fdef46d62
- MD5 1535e9a97b806f68f4ba60ebb390e6e8
- SHA1 936b64251d34f2b6e7cbfe6e74abec0e95c64039
- SHA512 74dd87b2e1d7130d546e7f5b890698d2b2d66f82dd396094a8d6a81bc82645fbf6beda9b2f472951d107e04fac2d35e443f22ba7bfbff202a05dc8042868cead
- SSDEEP 98304:khpBinjOykGcPdOR5fd0oAaldmdmnphdcPNevoirV0t/iLwHft8vAm:8pAnjOyAdOrfyKmd0jdcP2jrOOwH+v3
- TLSH T104E65B1162948FE9C05FD074CE4666B19A237C594F709BDF2A80BE693E326E06E3531F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule behavioral1/files/0x00130000000242fd-4.dat UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\rasautou.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\regedit.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\net.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\waitfor.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\autofmt.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\hdwwiz.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\lodctr.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\logagent.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\netbtugc.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\resmon.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\SyncHost.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\finger.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\hdwwiz.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\help.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\ndadmin.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\printui.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\SecEdit.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\Windows.WARP.JITService.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\regini.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\rundll32.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\schtasks.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\wevtutil.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\curl.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\makecab.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\NETSTAT.EXE 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\winver.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\explorer.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\xwizard.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\cacls.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\SettingSyncHost.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\SndVol.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\winrs.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\CheckNetIsolation.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\setup16.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\write.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\getmac.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\dfrgui.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\reg.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\sdchange.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\gpupdate.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\unlodctr.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\edpnotify.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\mavinject.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\OpenWith.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\RMActivate_ssp_isv.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\expand.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\extrac32.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\raserver.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\Robocopy.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\SystemUWPLauncher.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\TRACERT.EXE- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Windows Media Player\wmplayer.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\144.0.3719.93\elevated_tracing_service.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Windows Media Player\wmlaunch.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\uninstall.cmd 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\show_third_party_software_licenses.bat- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\144.0.3719.93\BHO\ie_to_edge_stub.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\144.0.3719.93\Installer\copilot_setup.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Internet Explorer\iexplore.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-isoburn_31bf3856ad364e35_10.0.19041.746_none_c42bf1ebf80a8661\isoburn.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_10.0.19041.928_none_6a67731cf3e151f2\f\pcaui.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wmi-core-providerhost_31bf3856ad364e35_10.0.19041.546_none_f8b0afde1e951639\WmiPrvSE.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-coresystem-wpr_31bf3856ad364e35_10.0.19041.207_none_4054ef70f69f6ff9\wpr.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-makecab_31bf3856ad364e35_10.0.19041.207_none_cef5032ec7ecd573\makecab.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.19041.1266_none_5fd6523a3130632d\f\systemreset.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.19041.1266_none_fb98272b39a47240\r\usocoreworker.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SystemApps\Microsoft.Windows.AppResolverUX_cw5n1h2txyewy\AppResolverUX.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_adobe-flash-for-windows_31bf3856ad364e35_10.0.19041.82_none_2358a116979cc599\FlashUtil_ActiveX.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-containerdiagnosticstool_31bf3856ad364e35_10.0.19041.928_none_6571ff6e96271a64\f\hcsdiag.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..lity-eoaexperiences_31bf3856ad364e35_10.0.19041.746_none_c291aefd01a5d6d6\r\EoAExperiences.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-explorer_31bf3856ad364e35_10.0.19041.1266_none_d0cf24ea634e86e3\f\explorer.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-icm-dccw_31bf3856ad364e35_10.0.19041.1_none_db3463b66241962d\dccw.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-unifiedwritefilter_31bf3856ad364e35_10.0.19041.1_none_522bacd027283125\UwfServicingShell.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lsa-minwin_31bf3856ad364e35_10.0.19041.1_none_f35caf2131abed9a\lsass.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-admincmdtools_31bf3856ad364e35_10.0.19041.1_none_6a9f2a3a3265ab31\nfsadmin.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.19041.1202_none_27f9f931a79d1cbe\r\mavinject.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..eldebugger-recorder_31bf3856ad364e35_10.0.19041.746_none_425d54d86cc1f3e2\r\tttracer.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-cloudnotifications_31bf3856ad364e35_10.0.19041.746_none_7a559100246cff2b\CloudNotifications.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SystemApps\microsoft.creddialoghost_cw5n1h2txyewy\CredDialogHost.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\f\AppVShNotify.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wab-app_31bf3856ad364e35_10.0.19041.1_none_f89a6b0476f024dd\wabmig.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-scripting_31bf3856ad364e35_10.0.19041.1237_none_c77fb947e9eed73b\f\cscript.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wow64-legacy_31bf3856ad364e35_10.0.19041.1_none_ac040ccaa73c8c1b\instnm.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.19041.1_none_44197b0fdd55f562\AccountsControlHost.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..screencontentserver_31bf3856ad364e35_10.0.19041.746_none_e540b68b09558f5a\r\LockScreenContentServer.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.19041.746_none_c7c6fccae233c8b7\f\uwfux.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-spelling-host.binaries_31bf3856ad364e35_10.0.19041.746_none_eb2cdd2a40f60c45\MsSpellCheckingHost.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-xbox-gamecallableui.appxmain_31bf3856ad364e35_10.0.19041.746_none_0119299746221375\XBox.TCUI.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.19041.746_none_790f12933fbf7e0d\rmttpmvscmgrsvr.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_multipoint-wmssvc_31bf3856ad364e35_10.0.19041.1_none_76b501b13155d66b\WmsSvc.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediafoundation_31bf3856ad364e35_10.0.19041.84_none_9e56f6c66f3fd630\mfpmp.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..temcompareutilities_31bf3856ad364e35_10.0.19041.1_none_b6b7b206d4b9d895\comp.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-quickassist_31bf3856ad364e35_10.0.19041.1266_none_7d1b4a535854fe42\r\quickassist.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.19041.264_none_9627a04e40f9f001\r\SearchFilterHost.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..raries-servercommon_31bf3856ad364e35_10.0.19041.264_none_876d2c71ceefefbb\iissetup.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-autochk_31bf3856ad364e35_10.0.19041.1266_none_610e6b21ab533b13\f\autochk.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_10.0.19041.1110_none_0565d41cd46ec20a\f\msinfo32.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.19041.423_none_6c3451a09cba3850\AccountsControlHost.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cipher_31bf3856ad364e35_10.0.19041.1_none_63078cde447629b6\cipher.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-htmlapplication_31bf3856ad364e35_11.0.19041.1_none_433c779d1394f332\mshta.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..plicationframe-host_31bf3856ad364e35_10.0.19041.746_none_b7a67ddd8bcc7470\r\ApplicationFrameHost.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_netfx4-aspnet_regiis_exe_b03f5f7f11d50a3a_4.0.15805.0_none_814c9c8a31da2279\aspnet_regiis.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-registry-editor_31bf3856ad364e35_10.0.19041.746_none_dc7caa836f08ad57\regedit.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-setx_31bf3856ad364e35_10.0.19041.1_none_6cbc8da4ecceab64\setx.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_state.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-gdi_31bf3856ad364e35_10.0.19041.264_none_87b4b95ab967b582\fontdrvhost.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lockapphost_31bf3856ad364e35_10.0.19041.746_none_d99fd60bc1fde773\f\LockAppHost.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..usnotificationuxexe_31bf3856ad364e35_10.0.19041.1266_none_e8d910c7c702b558\r\MusNotificationUx.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-storage-diagnostics_31bf3856ad364e35_10.0.19041.1_none_34f70c73dc049744\stordiag.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\WsatConfig.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ntalcontrolsmonitor_31bf3856ad364e35_10.0.19041.1266_none_bfb5312df2d5c960\f\WpcMon.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filehistory-core_31bf3856ad364e35_10.0.19041.1110_none_29d8ec742bfd8b13\fhmanagew.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.19041.1_none_15114cf4ffe3136a\cmdl32.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-speechcommonnoia64_31bf3856ad364e35_10.0.19041.1_none_b89a948362edb3e7\sapisvr.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\x86_wpf-xamlviewer_31bf3856ad364e35_10.0.19041.1_none_afe0be8163ecf7d4\XamlViewer_v0300.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_10.0.19041.746_none_5fb37340a423d88f\f\PrintBrm.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ieframe_31bf3856ad364e35_11.0.19041.264_none_863c21753674f968\r\IESettingSync.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2924
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 13.8MB
- SHA256 dc56909cbb2349657afa13131feaa5d463190747a03e15976cbe3fdee363ccb3
- MD5 07fda8c5a8f8a9d503ed2cb5360bd9df
- SHA1 b6764c54e9ec42d4ddb052d1b3c375a889b974d9
- SHA512 8e50c00062259002dd12397d9ff05866ead46633465e590b699e4c16f02611dd524ee8caa9b6a0077b12d78ced5fef9007ea3ea97d83e79becc7041dd4dd93ed
- SSDEEP 196608:8pAnjOyAdOrfyKmd0jdcP2jrOOwH+vjoh:OAnBqYjrOB+Uh
- TLSH T1CDE65B1172948FE9C05FD074CE4666B19A237C894F709BDF2680BE693E366E06A3531F
- MD5 SHA1 SHA512 SSDEEP TLSH