Analysis
- max time kernel
149s - max time network
131s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
15/04/2026, 14:17
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe
Resource
win11-20260130-en
windows11-21h2-x64
5 signatures
150 seconds
General
- Target 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe
- Size 11.7MB
- Sample260415-rl2bksbw4x
- SHA256 8fb34404871c60dbd351aad6586d3778f8b88653ce67c2226838f959d7a63477
- MD5 3f4cc17c0c89acc3369c904714ba1019
- SHA1 44743da77c315a0a3aab37e367c56d5e0a0c0ddf
- SHA512 302909ba7bb61bd71fa8267fd514d0e9e095bbac5f34a2d09e8fc31712147a5b34f39d3536d569d80a775d73d1b004de8bb01f6b78830d394e76a655596b78a8
- SSDEEP 196608:8pAnjOyAdOrf26Ud15rgTH2qBpu1QfLIqsufc:OAntAWTHNBpu1Qfc0c
- TLSH T169C63A1162D58FA9C06FD074CE4666A5AA333C854F309BDF1684BE293E366E05E3931F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule behavioral1/files/0x000a0000000242cc-4.dat UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\SearchFilterHost.exe 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\shutdown.exe 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\where.exe 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\ctfmon.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\ctfmon.exe 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\icacls.exe 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\msinfo32.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\net.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\tttracer.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\dpapimig.exe 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\resmon.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\resmon.exe 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\wextract.exe 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\ftp.exe 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\sdbinst.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\sdchange.exe 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\subst.exe 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\verclsid.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\setx.exe 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\stordiag.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\svchost.exe 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\CheckNetIsolation.exe 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\hdwwiz.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\more.com 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\nslookup.exe 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\relog.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\sfc.exe 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\choice.exe 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\reg.exe 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\certreq.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\Dism.exe 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\pcaui.exe 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\TCPSVCS.EXE- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\DpiScaling.exe 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\gpscript.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\mcbuilder.exe 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\odbcad32.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\recover.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\setupugc.exe 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\charmap.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\cmdkey.exe 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\dvdplay.exe 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\secinit.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\stordiag.exe 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\colorcpl.exe 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\lodctr.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\mode.com 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\prevhost.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\tracerpt.exe 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Windows Media Player\wmprph.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{B6A73AB1-30BD-4092-AEB0-C52DA4776C17}\MicrosoftEdge_X64_139.0.3405.125.exe 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Windows Media Player\setup_wm.exe 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\144.0.3719.93\cookie_exporter.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Windows Mail\wab.exe 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regbrowsers.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-x..jectdialog.appxmain_31bf3856ad364e35_10.0.19041.1_none_b1240cd13c584c1c\XGpuEjectDialog.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_windows-defender-service_31bf3856ad364e35_10.0.19041.746_none_a39f6d9ab59bd8b7\MsMpEng.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..onagent-proxyobject_31bf3856ad364e35_10.0.19041.1_none_23bb28d0952bcec8\RdpSaProxy.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-commandprompt_31bf3856ad364e35_10.0.19041.746_none_69061189792bce34\f\cmd.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..tional-chinese-core_31bf3856ad364e35_10.0.19041.1_none_0f750b10a0559386\IMTCLNWZ.EXE- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..snotificationbroker_31bf3856ad364e35_10.0.19041.153_none_42505a6de732f7ca\MusNotification.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_windows-shield-provider_31bf3856ad364e35_10.0.19041.1266_none_1abb9653828c3f41\r\SecurityHealthService.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SystemApps\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\UndockedDevKit.exe 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-servicing_31bf3856ad364e35_10.0.19041.1237_none_9ad73d125ac89655\f\bfsvc.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.19041.1266_none_802f96a5044b0fbe\f\wmpshare.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\msil_dfsvc_b03f5f7f11d50a3a_10.0.19041.1_none_26b5e44019fe7ae2\dfsvc.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-r..sistance-dcomserver_31bf3856ad364e35_10.0.19041.1110_none_af1474f55f209109\f\raserver.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..riseclientsync-host_31bf3856ad364e35_10.0.19041.207_none_ac38fc33d542b487\r\WorkFolders.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-logagent_31bf3856ad364e35_10.0.19041.1_none_a13199bb61665e9a\logagent.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\r\SecHealthUI.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_10.0.19041.546_none_93b4a0a1641d085c\svchost.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_windows-shield-provider_31bf3856ad364e35_10.0.19041.1266_none_1abb9653828c3f41\f\SecurityHealthHost.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-extrac32_31bf3856ad364e35_10.0.19041.1_none_9b6f5274d7a3ac24\extrac32.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..oler-filterpipeline_31bf3856ad364e35_10.0.19041.264_none_098f3a6c3a48359d\r\printfilterpipelinesvc.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-edge-microsoftedgecp_31bf3856ad364e35_10.0.19041.1_none_77274ce3b079d8f5\MicrosoftEdgeCP.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..alcontrols.appxmain_31bf3856ad364e35_10.0.19041.1266_none_1833f07ce0c90b68\WpcUapApp.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sensordataservice_31bf3856ad364e35_10.0.19041.746_none_dbfd31e3890afb72\SensorDataService.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..sition-uicomponents_31bf3856ad364e35_10.0.19041.1151_none_43c494653a7536d0\wiaacmgr.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-winrsplugins_31bf3856ad364e35_10.0.19041.1081_none_956906931b26e27a\winrs.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wpd-shellextension_31bf3856ad364e35_10.0.19041.1_none_d16ea4809a87fadb\WPDShextAutoplay.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager_31bf3856ad364e35_10.0.19041.1202_none_7cdad2e52790705d\wdagtool.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wslconfig_31bf3856ad364e35_10.0.19041.1151_none_15ecde7059d11b7f\wslconfig.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..nt-enrollmenthelper_31bf3856ad364e35_10.0.19041.746_none_18c3ddf7dbfedda0\r\PinEnrollmentBroker.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tokenbroker_31bf3856ad364e35_10.0.19041.264_none_81941817097d6ad9\TokenBrokerCookies.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unp_31bf3856ad364e35_10.0.19041.1266_none_21c0be7c0dad3632\f\UpdateNotificationMgr.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..packagedcwalauncher_31bf3856ad364e35_10.0.19041.1_none_a37f8905d149f29b\PackagedCWALauncher.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-legacyhwui_31bf3856ad364e35_10.0.19041.1_none_a2b9da391bff31c4\hdwwiz.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mapi_31bf3856ad364e35_10.0.19041.423_none_93adcfb5ace23a89\fixmapi.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\IEExec.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-d..ectxdatabaseupdater_31bf3856ad364e35_10.0.19041.84_none_2d21e26a18d595c7\directxdatabaseupdater.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-quickassist_31bf3856ad364e35_10.0.19041.1266_none_72c6a00123f43c47\quickassist.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-webcamexperience_31bf3856ad364e35_10.0.19041.746_none_4ae21b160a9d5bb2\f\CameraSettingsUIHost.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.1_none_7862ecae0548fb54\shrpubw.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.19041.1202_none_497a4c9b969ee5eb\winrm.cmd- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appidcore_31bf3856ad364e35_10.0.19041.1202_none_a391067a6b9b433c\r\appidtel.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dataexchangehost_31bf3856ad364e35_10.0.19041.264_none_c765d8a6c76ec25f\DataExchangeHost.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\f\MicrosoftPdfReader.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-openwith_31bf3856ad364e35_10.0.19041.1_none_2311dc3012116c15\OpenWith.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-b..re-memorydiagnostic_31bf3856ad364e35_10.0.19041.1202_none_574a25a5ee347454\f\memtest.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.1_none_c513167c1d0a90dd\icsunattend.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_networking-mpssvc-netsh_31bf3856ad364e35_10.0.19041.1151_none_2e15548db03a22c8\f\CheckNetIsolation.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.19041.1151_none_f68db62a3702882b\SearchFilterHost.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-console-host-core_31bf3856ad364e35_10.0.19041.153_none_4b81b20e830f375b\f\conhost.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.264_none_4de8bd849baaa96f\f\WerFault.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\f\MicrosoftEdge.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_10.0.19041.1237_none_4b16fb7fab206eb1\f\printui.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sysprep_31bf3856ad364e35_10.0.19041.1_none_a56fae4897d867d9\sysprep.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\x86_netfx4-applaunch_exe_b03f5f7f11d50a3a_4.0.15805.0_none_f04c7dcfd4283324\AppLaunch.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-office-csp_31bf3856ad364e35_10.0.19041.844_none_9b62a70f9278f2cd\ofdeploy.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.19041.1288_none_3f2d1be96237886e\winrm.cmd- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-explorer_31bf3856ad364e35_10.0.19041.264_none_39eaf2470cfe88f0\r\explorer.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..switch-toasthandler_31bf3856ad364e35_10.0.19041.746_none_b2e64138c9682982\f\InputSwitchToastHandler.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iscsi_initiator_ui_31bf3856ad364e35_10.0.19041.1_none_8ddc3834fb6f659f\iscsicpl.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.19041.844_none_d9eb415c5b9dbe4e\r\SecureAssessmentBrowser.exe- 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-15_3f4cc17c0c89acc3369c904714ba1019_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4368
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 12.2MB
- SHA256 c4348feab9d5b8e88ff2907fbdfe233979f0f593f0c2c04b8541691dbbb9d0a2
- MD5 6d1939bd6b53b164aac4ebbab5ce50fb
- SHA1 389bcbb83611974b7c4e0d76180d73511343e52b
- SHA512 3b0a2a47dfb163b2f51123ff53555bf821e33055509863112b8fb9dfdacad9e0094800456715f8320852c6f09f95569b0f4d0537a1f4534a1426a045a9d0940b
- SSDEEP 196608:8pAnjOyAdOrf26Ud15rgTH2qBpu1QfLIqsufWoK:OAntAWTHNBpu1Qfc0xK
- TLSH T1F7D64A1162958FA9C06FD074CD8666A5AA333C454F309FDF1684BE293E366E05E3932F
- MD5 SHA1 SHA512 SSDEEP TLSH