Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
16/04/2026, 16:02
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe
Resource
win11-20260130-en
windows11-21h2-x64
5 signatures
150 seconds
General
- Target 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe
- Size 10.4MB
- Sample260416-tgxtpsex4k
- SHA256 1bb669bae3b44f35b4d91c206e0a986d1d9bbb1364731a3c11793ceaaf37bd47
- MD5 810a0e8c71aea95bec7b2611ab90d27a
- SHA1 81c9f5bfc9aab20773de2220b631838fe1660af1
- SHA512 c56ceb07a70dc665ca606b8b27a1ca35b767d5fc6b3a05dd90e743cd2970a2569f6aebe364d05754c5bdd74e00be952a110a27251ea733d714b81d3b92909956
- SSDEEP 98304:khpBinjOykGcPdOR5fd46z6zY8zWDaDHiQ8QThoj7/PvOAjcXvvOOc5Nx:8pAnjOyAdOrf26zoRCHOAoXvvO1x
- TLSH T19FB69E1EB36842BAD0B3D1B9C9969706E671B4554730D7CF2284A35E2F777E24E3A320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule behavioral2/files/0x001d00000002b1db-4.dat UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\doskey.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\fsutil.exe 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\isoburn.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\rasphone.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\tree.com- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\waitfor.exe 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\ctfmon.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\icsunattend.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\rasphone.exe 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\rekeywiz.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\tar.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\dpnsvr.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\findstr.exe 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\msiexec.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\msinfo32.exe 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\unlodctr.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\edpnotify.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\grpconv.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\ipconfig.exe 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\appidtel.exe 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\colorcpl.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\mobsync.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\OneDriveSetup.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\regini.exe 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\appidtel.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\ddodiag.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\findstr.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\finger.exe 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\mavinject.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\mountvol.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\sxstrace.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\where.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\auditpol.exe 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\GamePanel.exe 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\PickerHost.exe 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\sfc.exe 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\taskkill.exe 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\wextract.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\wscript.exe 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\cttune.exe 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\gpscript.exe 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\odbcad32.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\CloudNotifications.exe 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\diskpart.exe 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\proquota.exe 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\svchost.exe 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\xwizard.exe 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\fsutil.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\tracerpt.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\dxdiag.exe 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\edpnotify.exe 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\makecab.exe 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\quickassist.exe 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\secinit.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\setupugc.exe 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Mozilla Firefox\firefox.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Windows Media Player\setup_wm.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Mozilla Firefox\updater.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Windows Mail\wab.exe 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Internet Explorer\ieinstal.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\show_third_party_software_licenses.bat 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateOnDemand.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Windows Mail\wab.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.exe 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_11.0.22000.120_none_e2284b7d90c8a180\f\iexplore.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ative-serverbox-isv_31bf3856ad364e35_10.0.22000.120_none_f07c0067839c600d\f\RMActivate_ssp_isv.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-shellappruntime_31bf3856ad364e35_10.0.22000.469_none_0defc0f5807dd5f0\r\ShellAppRuntime.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shutdown-event-tracker_31bf3856ad364e35_10.0.22000.1_none_5917b556ccc10b5e\shutdown.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-driververifier_31bf3856ad364e35_10.0.22000.1_none_1b04230fd5e53bb5\verifiergui.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..-odbc-administrator_31bf3856ad364e35_10.0.22000.1_none_a4e82f5676e0e198\odbcad32.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..rvices-sessionagent_31bf3856ad364e35_10.0.22000.1_none_dbea4e9985e12d2f\RdpSa.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\csc.exe 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-omadmclient_31bf3856ad364e35_10.0.22000.51_none_35df5a459d516a9e\f\omadmclient.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-gdi_31bf3856ad364e35_10.0.22000.132_none_a52f79fedfba2bb3\r\fontdrvhost.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..or-native-serverbox_31bf3856ad364e35_10.0.22000.120_none_6b23f06ce93f4f52\RMActivate_ssp.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.22000.282_none_cfe0738266c4e593\r\WSManHTTPConfig.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-s..ative-serverbox-isv_31bf3856ad364e35_10.0.22000.120_none_fad0aab9b7fd2208\f\RMActivate_ssp_isv.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-uevservice_31bf3856ad364e35_10.0.22000.100_none_791efb09af53b896\f\AgentService.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.22000.348_none_5519d2fa88b436fc\SearchFilterHost.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ices-appcompattools_31bf3856ad364e35_10.0.22000.1_none_49632d3770877d59\SETPATHS.CMD- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.22000.1_none_890a915053a73623\ROUTE.EXE- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft.windows.winhttp_31bf3856ad364e35_5.1.22000.1_none_9e1105ca4c207d1b\pacjsworker.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_netfx-mscorsvw_exe_b03f5f7f11d50a3a_10.0.22000.1_none_7512c1e2929b66b7\mscorsvw.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tasklist_31bf3856ad364e35_10.0.22000.1_none_88db7a29937b79fa\tasklist.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.22000.100_none_f82676266a17f522\UevAgentPolicyGenerator.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..frameworks-usermode_31bf3856ad364e35_10.0.22000.1_none_f3552e31fa0ca962\WUDFCompanionHost.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-nltest_31bf3856ad364e35_10.0.22000.318_none_95d72c738176ed2a\r\nltest.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sethc_31bf3856ad364e35_10.0.22000.1_none_b903dc9f79e461c1\EaseOfAccessDialog.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\msil_edmgen_b77a5c561934e089_10.0.22000.1_none_c5fd122e0036c04c\EdmGen.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.22000.469_none_3a8cfd7d7fe46760\f\wowreg32.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fileexplorer.appxmain_31bf3856ad364e35_10.0.22000.120_none_64d060998298410d\f\FileExplorer.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_regsvcs_b03f5f7f11d50a3a_10.0.22000.1_none_3f4beb1e121a63d1\RegSvcs.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-muicachebuilder_31bf3856ad364e35_10.0.22000.1_none_7aa4e433ee022a53\mcbuilder.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-mediafoundation_31bf3856ad364e35_10.0.22000.120_none_97c4601a91ef2a4b\f\mfpmp.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..mnotificationbroker_31bf3856ad364e35_10.0.22000.1_none_1df835c1eb7ab0fb\DmNotificationBroker.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filepicker.appxmain_31bf3856ad364e35_10.0.22000.120_none_bdd6ed7a5949f71c\r\FilePicker.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-setup-support_31bf3856ad364e35_11.0.22000.282_none_04af1ce80d4a389a\r\ie4uinit.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.22000.120_none_f759261c81fa2ed8\SecureAssessmentBrowser.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\x86_netfx4-ngentask_exe_b03f5f7f11d50a3a_4.0.15806.0_none_1bb1d4f67da2d938\ngentask.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.22000.348_none_1cb0f82bf1aef3cc\f\lpremove.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-security-spp-ux_31bf3856ad364e35_10.0.22000.348_none_571935de2408ae28\f\slui.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.22000.469_none_5669b3acf1ecab58\r\winload.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-omadmclient_31bf3856ad364e35_10.0.22000.469_none_4ee2cfd406c59bc7\f\omadmclient.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..devicescontrolpanel_31bf3856ad364e35_10.0.22000.1_none_7ae3697a4deac0fe\ImagingDevices.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bcdboot-cmdlinetool_31bf3856ad364e35_10.0.22000.194_none_5c736727c3870f49\bcdboot.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msconfig-exe_31bf3856ad364e35_10.0.22000.71_none_bcb9c63bb991a4c6\r\msconfig.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..monotificationuxexe_31bf3856ad364e35_10.0.22000.282_none_618940d4a376d501\f\MoNotificationUx.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.22000.376_none_a359e3d81485694b\n\SenseCM.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..d-searchintegration_31bf3856ad364e35_10.0.22000.1_none_e64ff994c88b8371\IMESEARCH.EXE- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wordpad_31bf3856ad364e35_10.0.22000.1_none_8e52c12ba60f5a2c\wordpad.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.22000.282_none_c58bc93032642398\f\wsmprovhost.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mapi-mmga_31bf3856ad364e35_10.0.22000.1_none_2c8e6409d7552dca\mmgaserver.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoftwindowssystemrestore-tasks_31bf3856ad364e35_10.0.22000.1_none_8ad2d5434aef8a0e\SrTasks.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_wpf-presentationhostexe_31bf3856ad364e35_10.0.22000.1_none_c637d0f724e6f1a9\PresentationHost.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.22000.120_none_7c599f579e2e019d\SpatialAudioLicenseSrv.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\x86_netfx35linq-linqwebconfig_31bf3856ad364e35_10.0.22000.1_none_5131b7cb34740693\LinqWebConfig.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\jsc.exe 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\vbc.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_product-containeros__windowssearchengine_31bf3856ad364e35_7.0.22000.348_none_20c655d14680f9cf\f\SearchProtocolHost.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SystemApps\microsoft.creddialoghost_cw5n1h2txyewy\CredDialogHost.exe 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setupcl_31bf3856ad364e35_10.0.22000.1_none_aef2a379f0110144\setupcl.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_netfx35linq-addinutil_31bf3856ad364e35_10.0.22000.1_none_2161d6cde824ee93\AddInUtil.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-proquota_31bf3856ad364e35_10.0.22000.1_none_885f3fcfcb8efd54\proquota.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..ter-cimprovider-exe_31bf3856ad364e35_10.0.22000.1_none_c3e1e602251fe636\Register-CimProvider.exe- 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-16_810a0e8c71aea95bec7b2611ab90d27a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4532
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 10.9MB
- SHA256 7b32798a39a3a967b906089a97d4e367bfd04a7f0ce166138704db62c3e3038f
- MD5 3d11100160bd31b52719980aa30231fa
- SHA1 a033188ddacb96eedec8c31aa9cd335fe55543dc
- SHA512 d0e0f490bb5b5f75bba2653a1c7542ca90b833effc6b39e9d4fd7ba37e6051451aca2a19a0856957621dc6d0100b19c2c3be4128854f05d33386c80740505643
- SSDEEP 98304:khpBinjOykGcPdOR5fd46z6zY8zWDaDHiQ8QThoj7/PvOAjcXvvOOc5NFjo5:8pAnjOyAdOrf26zoRCHOAoXvvO1Ro5
- TLSH T1D1B69E1EB36842BAD0B3D0B9C5969706E67174554730D7CF2284A76D2F77BE28E3A320
- MD5 SHA1 SHA512 SSDEEP TLSH