Analysis
- max time kernel
149s - max time network
154s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
16/04/2026, 12:30
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win11-20260130-en
windows11-21h2-x64
7 signatures
150 seconds
General
- Target 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
- Size 9.1MB
- Sample260416-pptpssat7z
- SHA256 4c36638e5208404ad068cb79582d05e057856e518e782c17e7d23f61d0e72eca
- MD5 3344800d5a81c73b666795bf848e7130
- SHA1 17196986fd165150fff6e5763b4805397a84e023
- SHA512 0b83a574a7440c2e57498b9e252854ec56af810f31a74a66dc144b7a6a4073ba261b9e5022e1c11437851faa0d95ec35f0b1b4b26ac79c89041222577b4a178d
- SSDEEP 98304:khpBinjOykGcPdOR5NTIOSAP6eLapIvdVDkjol:8pAnjOyAdOrNTfL6ecIvdVSol
- TLSH T1C2A67C1272E00137D0AA917ACA65472597B13C7A8BF2C3DB7144B6D92E737C27A37722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral2/files/0x003200000002b13e-4.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Custom signatureDetects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral2/files/0x003200000002b13e-4.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Custom signatureUPX dump on OEP (original entry point) 1 IoCs
resource yara_rule behavioral2/files/0x003200000002b13e-4.dat UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\fc.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\gpresult.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\systray.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\TpmTool.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ftp.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\label.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\poqexec.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Utilman.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Com\comrepl.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\LaunchTM.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\TpmInit.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\chcp.com- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\dllhost.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\logman.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\mountvol.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SecEdit.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\tree.com 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\certreq.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Dism.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\at.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\bitsadmin.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\bthudtask.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cacls.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\control.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\explorer.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Magnify.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\rasautou.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\certutil.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\relog.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\TRACERT.EXE 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\unregmp2.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\where.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wlanext.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\attrib.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cmdkey.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\fontview.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\fontview.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\efsui.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\fixmapi.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\mode.com 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\OpenWith.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\sxstrace.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\calc.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\dvdplay.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\lodctr.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\rasdial.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\typeperf.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cipher.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\relog.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\tttracer.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wiaacmgr.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\dtdump.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\recover.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wlanext.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\fltMC.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Internet Explorer\ExtExport.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Mail\wabmig.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\show_third_party_software_licenses.bat- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Internet Explorer\ExtExport.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Internet Explorer\ieinstal.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.22000.376_none_a359e3d81485694b\f\MsSense.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..hreshold-adminflows_31bf3856ad364e35_10.0.22000.100_none_1c26ef58a3003bf2\r\SystemSettingsAdminFlows.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.22000.348_none_7c4c059b9e36fe85\r\SpatialAudioLicenseSrv.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-cleanmgr_31bf3856ad364e35_10.0.22000.1_none_cddc7e5996b5a69e\cleanmgr.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..onment-core-tcbboot_31bf3856ad364e35_10.0.22000.318_none_fbf48b4fce07c440\r\tcblaunch.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..anagement-dmcfghost_31bf3856ad364e35_10.0.22000.1_none_7a72c4e477e7b25d\dmcfghost.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediafoundation_31bf3856ad364e35_10.0.22000.120_none_97c4601a91ef2a4b\mfpmp.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..msettings-datamodel_31bf3856ad364e35_10.0.22000.65_none_cc4646d618bda56e\r\SystemSettingsBroker.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..riencehost.appxmain_31bf3856ad364e35_10.0.22000.120_none_f6a11a34378fa70f\StartMenuExperienceHost.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..vercommandlinetools_31bf3856ad364e35_10.0.22000.1_none_10872c88a98c0f77\flattemp.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_netfx-cvtres_for_vc_and_vb_b03f5f7f11d50a3a_10.0.22000.1_none_3adcb6f6de313c9e\cvtres.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.22000.348_none_5519d2fa88b436fc\r\SearchFilterHost.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-setup-support_31bf3856ad364e35_11.0.22000.348_none_04e0603a0d245e07\ie4uinit.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_10.0.22000.194_none_d171c2327b4ef3a7\printui.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.22000.1_none_b563dd17654ea05f\cmmon32.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.469_none_04a25ac34c904574\poqexec.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-b..re-memorydiagnostic_31bf3856ad364e35_10.0.22000.318_none_de01ffa2be1c4596\memtest.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..native-whitebox-isv_31bf3856ad364e35_10.0.22000.120_none_ef0bb92fa937f7ee\f\RMActivate_isv.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.22000.493_none_5c6bd6283c0b8362\r\CustomInstallExec.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_10.0.22000.71_none_688486d306b27285\r\msinfo32.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-setspn_31bf3856ad364e35_10.0.22000.1_none_d6493f0fe2ece5ee\setspn.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux_31bf3856ad364e35_10.0.22000.348_none_571935de2408ae28\f\slui.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_wpf-presentationfontcache_31bf3856ad364e35_10.0.22000.1_none_5bdd347516f7252a\PresentationFontCache.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-whoami_31bf3856ad364e35_10.0.22000.1_none_2f14c64ebafffe2c\whoami.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-lsa-minwin_31bf3856ad364e35_10.0.22000.434_none_38ca096a17805fa9\f\lsass.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..services-core-files_31bf3856ad364e35_10.0.22000.318_none_8b633995ac1a50de\dsamain.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eventlog-commandline_31bf3856ad364e35_10.0.22000.469_none_bc172f1a0215d298\r\wevtutil.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-networkux-legacyux_31bf3856ad364e35_10.0.22000.1_none_73c734e8920ab338\LegacyNetUXHost.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-parentalcontrols-ots_31bf3856ad364e35_10.0.22000.37_none_7461fc8593f740b9\ApproveChildRequest.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-lsatrustlet_31bf3856ad364e35_10.0.22000.434_none_dff7d1ca03eba43a\LsaIso.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core-providerhost_31bf3856ad364e35_10.0.22000.348_none_0bba55ae109b8677\WmiPrvSE.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-explorer_31bf3856ad364e35_10.0.22000.469_none_574c4adf3362fbca\f\explorer.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regbrowsers.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-edge-microsoftedgesh_31bf3856ad364e35_10.0.22000.1_none_1ee8cf461114ced2\MicrosoftEdgeSH.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-gdi_31bf3856ad364e35_10.0.22000.348_none_a52aaf9adfbcd9fc\f\fontdrvhost.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.22000.1_none_f49ae11ddec89744\LicensingUI.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_multipoint-wmssvc_31bf3856ad364e35_10.0.22000.1_none_170791d396c16360\WmsSvc.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ie-ielowutil_31bf3856ad364e35_11.0.22000.1_none_348c892128803a3c\ielowutil.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..estartup-change-pin_31bf3856ad364e35_10.0.22000.194_none_ecba39f8d9cbe846\f\bdechangepin.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-warp-jitexecutable_31bf3856ad364e35_10.0.22000.1_none_23fdac7926f37c5a\Windows.WARP.JITService.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.22000.348_none_6b5eb3c4c1ffcde9\f\WerFault.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.22000.1_none_b563dd17654ea05f\cmdl32.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sxs_31bf3856ad364e35_10.0.22000.1_none_049039c25c6cceaa\sxstrace.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wlan-extension_31bf3856ad364e35_10.0.22000.1_none_5026ccd428229c6c\wlanext.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_netfx-clr_ilasm_exe_b03f5f7f11d50a3a_10.0.22000.1_none_582cc1ca37f0fcbb\ilasm.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.22000.376_none_a359e3d81485694b\f\SenseNdr.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..tegrity-diagnostics_31bf3856ad364e35_10.0.22000.1_none_c29d51ccbc2353b7\CIDiag.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.22000.318_none_2da4853532607174\f\AuditShD.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.22000.282_none_cfe0738266c4e593\WSManHTTPConfig.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.22000.65_none_90fb210207715818\r\Taskmgr.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appresolverux.appxmain_31bf3856ad364e35_10.0.22000.120_none_fc8d986a0ba4c584\r\AppResolverUX.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dpiscaling_31bf3856ad364e35_10.0.22000.1_none_d08b70dc5fb929d4\DpiScaling.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-nltest_31bf3856ad364e35_10.0.22000.318_none_95d72c738176ed2a\nltest.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.22000.1_none_7181babcedfc2cb7\iisreset.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-recover_31bf3856ad364e35_10.0.22000.1_none_e6ab95c6edc4d4dd\recover.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-mediafoundation_31bf3856ad364e35_10.0.22000.120_none_a2190a6cc64fec46\f\mfpmp.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..native-whitebox-isv_31bf3856ad364e35_10.0.22000.120_none_e4b70edd74d735f3\RMActivate_isv.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.22000.469_none_e653782f0144d814\f\SysResetErr.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.22000.1_none_7181babcedfc2cb7\aspnetca.exe- 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1800
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 9.6MB
- SHA256 b297df8797880ccbc962bbd1a166a365316053e2dc75a8aecc4de43fc9736b8e
- MD5 2c2c20691f84e6e969104a8062bb48fc
- SHA1 f98713a4871c4acecae3a998df515ed91389a4c4
- SHA512 f6485b3f8a11bbbe4059fb41b1e494f9dfca2418f1d218d49f241f92b900008c3731be2f8dbfdc681932c6c7900938140bbb63170712a0792c1c974466c6a0f8
- SSDEEP 98304:khpBinjOykGcPdOR5NTIOSAP6eLapIvdVDkjohjoc:8pAnjOyAdOrNTfL6ecIvdVSoloc
- TLSH T1AAA67C12B2E00237D0A6917ACAA54729D7B13C7A4BF1C3DB7144B6DD2E737C2A536722
- MD5 SHA1 SHA512 SSDEEP TLSH