Analysis
- max time kernel
149s - max time network
94s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
16/04/2026, 12:30
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win11-20260130-en
windows11-21h2-x64
7 signatures
150 seconds
General
- Target 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
- Size 9.1MB
- Sample260416-pptpssat7z
- SHA256 4c36638e5208404ad068cb79582d05e057856e518e782c17e7d23f61d0e72eca
- MD5 3344800d5a81c73b666795bf848e7130
- SHA1 17196986fd165150fff6e5763b4805397a84e023
- SHA512 0b83a574a7440c2e57498b9e252854ec56af810f31a74a66dc144b7a6a4073ba261b9e5022e1c11437851faa0d95ec35f0b1b4b26ac79c89041222577b4a178d
- SSDEEP 98304:khpBinjOykGcPdOR5NTIOSAP6eLapIvdVDkjol:8pAnjOyAdOrNTfL6ecIvdVSol
- TLSH T1C2A67C1272E00137D0AA917ACA65472597B13C7A8BF2C3DB7144B6D92E737C27A37722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral1/files/0x001c000000024192-4.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Custom signatureDetects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral1/files/0x001c000000024192-4.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Custom signatureUPX dump on OEP (original entry point) 1 IoCs
resource yara_rule behavioral1/files/0x001c000000024192-4.dat UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\compact.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\grpconv.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\PresentationHost.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\sdiagnhost.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\sort.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\explorer.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\fsquirt.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\w32tm.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\help.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\secinit.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\sethc.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\userinit.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\srdelayed.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cmdkey.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\iscsicli.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\net.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\winrm.cmd 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\logagent.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\clip.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\dpapimig.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Taskmgr.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\dfrgui.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\hdwwiz.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ttdinject.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\fontdrvhost.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\gpupdate.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\poqexec.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\verifiergui.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\findstr.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\mmc.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\mfpmp.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\net1.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\nslookup.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\OneDriveSetup.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ReAgentc.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wiaacmgr.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\attrib.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\newdev.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\sxstrace.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cmstp.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\fixmapi.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\getmac.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\label.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\regini.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cleanmgr.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\control.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\mspaint.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\reg.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\stordiag.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\control.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\convert.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\rasdial.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\dotnet\dotnet.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\7-Zip\7zFM.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Internet Explorer\ExtExport.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Mail\wab.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\ink\mip.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{96111401-1D2F-4E9F-9733-DA1B043CD4E7}\MicrosoftEdge_X64_139.0.3405.125.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\UpdateEnter.bat 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\wow64_microsoft-windows-com-dtc-tracing_31bf3856ad364e35_10.0.19041.1_none_d8250298c68d9cb6\msdtcvtr.bat- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-powershell-exe_31bf3856ad364e35_10.0.19041.546_none_5163f0069562aff6\powershell.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.84_none_81616275259e37fe\f\ImeBroker.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_10.0.19041.1266_none_22b99d078bbc3016\setup_wm.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..teelevatedinstaller_31bf3856ad364e35_10.0.19041.1_none_3b7fdf76aa8cfd53\WindowsUpdateElevatedInstaller.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-iediag_31bf3856ad364e35_11.0.19041.1_none_00c2b5589b88ca78\iediagcmd.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..player-shellpreview_31bf3856ad364e35_10.0.19041.1266_none_3563a6b72868b6d9\r\wmprph.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pcwdiagnostic_31bf3856ad364e35_10.0.19041.1_none_ab1cdb679f059ace\pcwrun.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-b..nfrastructurebghost_31bf3856ad364e35_10.0.19041.546_none_5940d1a4fc4ad8f3\r\backgroundTaskHost.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_10.0.19041.1110_none_0565d41cd46ec20a\f\msinfo32.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-thumbexthost_31bf3856ad364e35_10.0.19041.746_none_d8baedf8d09aba05\r\ThumbnailExtractionHost.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\x86_netfx-cvtres_for_vc_and_vb_b03f5f7f11d50a3a_10.0.19041.1_none_a6a8b89bc50eae31\cvtres.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.1202_none_23a707c9a0b5a8e1\r\LaunchTM.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1288_none_71734bf99a2a6955\Microsoft.Uev.CscUnpinTool.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..d-searchintegration_31bf3856ad364e35_10.0.19041.746_none_63b0fc68ee30f2cb\r\IMESEARCH.EXE- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.19041.1_none_805682e34c6552d0\winrm.cmd- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.19041.1237_none_a9b815907b71fe1a\f\wowreg32.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.19041.1266_none_fb98272b39a47240\r\usocoreworker.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_49716c2392052aca\r\diskperf.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.1_none_7862ecae0548fb54\shrpubw.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-winrsplugins_31bf3856ad364e35_10.0.19041.1081_none_956906931b26e27a\winrs.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMConfigInstaller.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.19041.746_none_790f12933fbf7e0d\tpmvscmgr.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sensordataservice_31bf3856ad364e35_10.0.19041.746_none_dbfd31e3890afb72\SensorDataService.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_windows-shield-provider_31bf3856ad364e35_10.0.19041.84_none_9d98e005fb7852ca\f\SecurityHealthService.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.19041.1081_none_f28ba6a10743aebc\r\SpeechModelDownload.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SystemApps\NcsiUwpApp_8wekyb3d8bbwe\NcsiUwpApp.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ed-chinese-moimeexe_31bf3856ad364e35_10.0.19041.746_none_c3054a007d804943\ChsIME.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-smartscreen_31bf3856ad364e35_10.0.19041.1052_none_323c9a9ad543e3a3\r\smartscreen.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.19041.1081_none_e836fc4ed2e2ecc1\r\SpeechModelDownload.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_9aa166e99861c2bc\chglogon.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..onwakesettingflyout_31bf3856ad364e35_10.0.19041.746_none_8a469514405342ff\PasswordOnWakeSettingFlyout.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-xcopy_31bf3856ad364e35_10.0.19041.1_none_233b627ec80a87f1\xcopy.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-iechooser_31bf3856ad364e35_11.0.19041.746_none_122a74c9827fe81a\IEChooser.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_10.0.19041.1110_none_fb1129caa00e000f\r\msinfo32.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SystemApps\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\SecureAssessmentBrowser.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-grouppolicy-script_31bf3856ad364e35_10.0.19041.572_none_42ec0e96ce977bdb\gpscript.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wslhost_31bf3856ad364e35_10.0.19041.117_none_9be21f0ef860b570\r\wslhost.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_9aa166e99861c2bc\chgport.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..ommand-line-utility_31bf3856ad364e35_10.0.19041.1_none_61ef8d34a0953a91\WMIC.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-help-client_31bf3856ad364e35_10.0.19041.1_none_22099da5cd743768\HelpPane.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wslconfig_31bf3856ad364e35_10.0.19041.117_none_7f3778d7035d9622\f\wslconfig.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-s..chservice-component_31bf3856ad364e35_10.0.19041.1266_none_2262e67641106c48\SpeechRuntime.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1288_none_71734bf99a2a6955\f\Microsoft.Uev.CscUnpinTool.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.19041.1266_none_07a5d18b92d8b668\r\cmproxyd.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-setup-support_31bf3856ad364e35_11.0.19041.1081_none_7e66aef13d0cb227\ie4ushowIE.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..-diagnostic-results_31bf3856ad364e35_10.0.19041.1_none_ded7404f8608d19f\MdRes.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..client-decoder-host_31bf3856ad364e35_10.0.19041.207_none_00b5dbdfab19326f\f\UtcDecoderHost.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-console-host-core_31bf3856ad364e35_10.0.19041.1288_none_e25de9f9d964cdad\conhost.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deployment_31bf3856ad364e35_10.0.19041.746_none_d9e841974c1d46e8\f\setupugc.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pnphotplugui_31bf3856ad364e35_10.0.19041.1_none_9ed23f0cea1bf54e\DeviceEject.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..biometrics-trustlet_31bf3856ad364e35_10.0.19041.1266_none_ba0845abb58c8bdd\BioIso.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-lsatrustlet_31bf3856ad364e35_10.0.19041.1288_none_5961108733e967c9\f\LsaIso.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-alg_31bf3856ad364e35_10.0.19041.746_none_86e29cecb9edce01\r\alg.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1_none_b29cb2f3845833b7\UevAppMonitor.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..services-core-files_31bf3856ad364e35_10.0.19041.1_none_45dc4032c659ae7c\dsamain.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sensordataservice_31bf3856ad364e35_10.0.19041.1_none_b3f4f49ac9993d28\SensorDataService.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft.windows.winhttp_31bf3856ad364e35_5.1.19041.264_none_7517ff6e147bc8a9\f\pacjsworker.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-b..re-memorydiagnostic_31bf3856ad364e35_10.0.19041.1_none_987b063fd85ba334\memtest.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-control_31bf3856ad364e35_10.0.19041.423_none_81cc87a43da05fd1\control.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-directshow-dvdplay_31bf3856ad364e35_10.0.19041.1_none_c1f3db00edc86845\dvdplay.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3480
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 9.6MB
- SHA256 b297df8797880ccbc962bbd1a166a365316053e2dc75a8aecc4de43fc9736b8e
- MD5 2c2c20691f84e6e969104a8062bb48fc
- SHA1 f98713a4871c4acecae3a998df515ed91389a4c4
- SHA512 f6485b3f8a11bbbe4059fb41b1e494f9dfca2418f1d218d49f241f92b900008c3731be2f8dbfdc681932c6c7900938140bbb63170712a0792c1c974466c6a0f8
- SSDEEP 98304:khpBinjOykGcPdOR5NTIOSAP6eLapIvdVDkjohjoc:8pAnjOyAdOrNTfL6ecIvdVSoloc
- TLSH T1AAA67C12B2E00237D0A6917ACAA54729D7B13C7A4BF1C3DB7144B6DD2E737C2A536722
- MD5 SHA1 SHA512 SSDEEP TLSH