Analysis
- max time kernel
149s - max time network
94s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
15/04/2026, 23:21
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe
Resource
win11-20260130-en
windows11-21h2-x64
5 signatures
150 seconds
General
- Target 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe
- Size 13.2MB
- Sample260415-3b3mfaes2y
- SHA256 46ebb542b2d7ea36e9ef1be4cafc8e6545ac0f2e524f8fd1e6c7677fdef46d62
- MD5 1535e9a97b806f68f4ba60ebb390e6e8
- SHA1 936b64251d34f2b6e7cbfe6e74abec0e95c64039
- SHA512 74dd87b2e1d7130d546e7f5b890698d2b2d66f82dd396094a8d6a81bc82645fbf6beda9b2f472951d107e04fac2d35e443f22ba7bfbff202a05dc8042868cead
- SSDEEP 98304:khpBinjOykGcPdOR5fd0oAaldmdmnphdcPNevoirV0t/iLwHft8vAm:8pAnjOyAdOrfyKmd0jdcP2jrOOwH+v3
- TLSH T104E65B1162948FE9C05FD074CE4666B19A237C594F709BDF2A80BE693E326E06E3531F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule behavioral2/files/0x001a00000002b331-4.dat UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\curl.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\mmc.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\subst.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\where.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\wiaacmgr.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\explorer.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\openfiles.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\winrm.cmd 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\regedit.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\mcbuilder.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\dxdiag.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\msinfo32.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\PATHPING.EXE- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\iscsicpl.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\logagent.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\PresentationHost.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\SyncHost.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\winver.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\dllhost.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\format.com 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\newdev.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\colorcpl.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\eudcedit.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\rundll32.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\eventcreate.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\odbcconf.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\odbcconf.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\mshta.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\tasklist.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\certreq.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\gpupdate.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\Utilman.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\attrib.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\help.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\schtasks.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\wlanext.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\lodctr.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\Msdtc\Trace\msdtcvtr.bat- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\ndadmin.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\net1.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\srdelayed.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\charmap.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\logagent.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\perfhost.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Windows Media Player\wmplayer.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdate.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Windows Mail\wabmig.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\7-Zip\7z.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Windows Mail\wab.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Windows NT\Accessories\wordpad.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\7-Zip\Uninstall.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-shell-oneoffs-em_31bf3856ad364e35_10.0.22000.318_none_ed2b4c25cc173a5f\n\EM.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.22000.376_none_c7a79de54d7799ec\f\AppVStreamingUX.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tabletpc-inputpanel_31bf3856ad364e35_10.0.22000.65_none_f3a35be8937453f0\r\TabTip.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.22000.282_none_5faf7b34bce42c4c\r\SearchFilterHost.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\x86_netfx-applaunch_exe_b03f5f7f11d50a3a_10.0.22000.1_none_6200919c299287d9\AppLaunch.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..tegrity-diagnostics_31bf3856ad364e35_10.0.22000.1_none_c29d51ccbc2353b7\CIDiag.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-unifiedwritefilter_31bf3856ad364e35_10.0.22000.1_none_f27e3cf28c93be1a\UwfServicingSvc.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ipconfig_31bf3856ad364e35_10.0.22000.1_none_a27d8ea61cb7b5c1\ipconfig.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-x..rtificateenrollment_31bf3856ad364e35_10.0.22000.434_none_eef51ebf13d8d8a1\CertEnrollCtrl.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-eventcollector_31bf3856ad364e35_10.0.22000.1_none_5ba5eadfaddccaf4\wecutil.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-registry-editor_31bf3856ad364e35_10.0.22000.1_none_54c6fd5d15027c02\regedit.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-international-unattend_31bf3856ad364e35_10.0.22000.1_none_20b20a4d26c387fd\MuiUnattend.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.493_none_81cdab704eaad423\f\SearchHost.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..pgrade-subscription_31bf3856ad364e35_10.0.22000.1_none_a7b29fe42d04be58\ClipRenew.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appresolverux.appxmain_31bf3856ad364e35_10.0.22000.120_none_fc8d986a0ba4c584\f\AppResolverUX.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-oobe-machine_31bf3856ad364e35_10.0.22000.1_none_63c1e7db07fabcb1\msoobe.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..-odbc-administrator_31bf3856ad364e35_10.0.22000.1_none_a4e82f5676e0e198\odbcad32.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sethc_31bf3856ad364e35_10.0.22000.1_none_c35886f1ae4523bc\EaseOfAccessDialog.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.22000.348_none_5f6e7d4cbd14f8f7\r\SearchProtocolHost.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\jsc.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-parentalcontrols-ots_31bf3856ad364e35_10.0.22000.37_none_7461fc8593f740b9\f\ApproveChildRequest.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_windowssearchengine_31bf3856ad364e35_7.0.22000.348_none_5519d2fa88b436fc\f\SearchFilterHost.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tapicore_31bf3856ad364e35_10.0.22000.1_none_3a7d76304b5fadc7\dialer.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.22000.348_none_7c4c059b9e36fe85\f\SpatialAudioLicenseSrv.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-chkdsk_31bf3856ad364e35_10.0.22000.1_none_227ea1d8c5da52fb\chkdsk.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\x86_microsoft-windows-a..cation-creduibroker_31bf3856ad364e35_10.0.22000.1_none_c4e0220059a427b2\CredentialUIBroker.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_windowssearchengine_31bf3856ad364e35_7.0.22000.348_none_5519d2fa88b436fc\f\SearchIndexer.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lications-clientsku_31bf3856ad364e35_10.0.22000.282_none_1a017429cb7fea2c\f\rdpinit.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.22000.1_none_890a915053a73623\finger.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_windows-securityhealth-sso_31bf3856ad364e35_10.0.22000.100_none_bac6834bfb16b20d\r\SecurityHealthSystray.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMConfigInstaller.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-host-service_31bf3856ad364e35_10.0.22000.376_none_f2dd928d310396ab\r\vmcompute.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..ing-platform-client_31bf3856ad364e35_10.0.22000.71_none_eba5201bcfa1aa33\licensingdiag.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.22000.493_none_5c6bd6283c0b8362\r\CustomInstallExec.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-clip_31bf3856ad364e35_10.0.22000.1_none_fe1f7fc320ca8300\clip.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-feedsbs_31bf3856ad364e35_11.0.22000.1_none_868307884a64f50c\msfeedssync.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..eminputhost-process_31bf3856ad364e35_10.0.22000.120_none_842c9d9e843cf6c7\r\ISM.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-recdisc-main_31bf3856ad364e35_10.0.22000.1_none_dabf9817b86a5921\recdisc.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.22000.282_none_10e4c14208d6d2d3\f\wmplayer.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-certutil_31bf3856ad364e35_10.0.22000.434_none_b0e36fb9b88e8b56\r\certutil.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.493_none_81cdab704eaad423\f\SearchHost.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vssservice_31bf3856ad364e35_10.0.22000.282_none_55f322479d33cb0a\VSSVC.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_10.0.22000.65_none_6e6aca3ab1161ee5\pcaui.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-com-surrogate-core_31bf3856ad364e35_10.0.22000.1_none_9582d7fd0fc1e753\dllhost.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.22000.1_none_4548a15e322e11ac\tscon.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-tpm-tool_31bf3856ad364e35_10.0.22000.282_none_03b4c900a639c980\f\TpmTool.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\OOBENetworkConnectionFlow.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..client-decoder-host_31bf3856ad364e35_10.0.22000.318_none_1e08617dd1895eb7\r\UtcDecoderHost.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.22000.1_none_ddb5359fa07e69e6\subst.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_10.0.22000.71_none_72d931253b133480\msinfo32.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-xbox-gameoverlay_31bf3856ad364e35_10.0.22000.1_none_9f4e11aa607a66b3\GamePanel.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.22000.65_none_9b4fcb543bd21a13\f\Taskmgr.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..s-mdac-odbcconf-exe_31bf3856ad364e35_10.0.22000.1_none_63ba7822f6e64972\odbcconf.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-klist_31bf3856ad364e35_10.0.22000.282_none_3c5af3814be830ab\r\klist.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-musnotifyiconexe_31bf3856ad364e35_10.0.22000.282_none_345ca27cf9ce36c0\MusNotifyIcon.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iscsi_initiator_ui_31bf3856ad364e35_10.0.22000.1_none_388372a9953bb48f\iscsicpl.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-runlegacycplelevated_31bf3856ad364e35_10.0.22000.1_none_71a457162e76ab00\RunLegacyCPLElevated.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..ing-management-host_31bf3856ad364e35_10.0.22000.1_none_2790769f75be6dd7\DismHost.exe- 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-15_1535e9a97b806f68f4ba60ebb390e6e8_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3852
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 13.8MB
- SHA256 dc56909cbb2349657afa13131feaa5d463190747a03e15976cbe3fdee363ccb3
- MD5 07fda8c5a8f8a9d503ed2cb5360bd9df
- SHA1 b6764c54e9ec42d4ddb052d1b3c375a889b974d9
- SHA512 8e50c00062259002dd12397d9ff05866ead46633465e590b699e4c16f02611dd524ee8caa9b6a0077b12d78ced5fef9007ea3ea97d83e79becc7041dd4dd93ed
- SSDEEP 196608:8pAnjOyAdOrfyKmd0jdcP2jrOOwH+vjoh:OAnBqYjrOB+Uh
- TLSH T1CDE65B1172948FE9C05FD074CE4666B19A237C894F709BDF2680BE693E366E06A3531F
- MD5 SHA1 SHA512 SSDEEP TLSH