Analysis
- max time kernel
149s - max time network
95s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
19/04/2026, 00:56
Behavioral task
behavioral1
Sample
2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
- Size 7.3MB
- Sample260419-batjlaaz5r
- SHA256 5931c88115886280da2744fa959b2c741788867e284ba56615f33aecb8ebc3b8
- MD5 ffa3c0099df3a8ca56fd882f75602b31
- SHA1 581174a31ad21e4c4489232e2a01dde1e7b09ebc
- SHA512 c1ea711130f74633cd8d66ba286d91aa2aeea052b1779f71f351e17a85e8228272159dad4c49981d792fa21aea15462ea59626f2c292a3ab4d4e5e47eed6def0
- SSDEEP 98304:lhpBinjOykGcPdOR5fd0oAaldmdmnphdBRQjop:TpAnjOyAdOrfyKmd0jdB4op
- TLSH T1CB768D02B29442B6D0A3D175CA969721DB713C690BF1D2EF3284B6D93E337D17A3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Custom signatureUPX dump on OEP (original entry point) 1 IoCs
resource yara_rule behavioral2/files/0x00090000000293eb-5.dat UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\fixmapi.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\icacls.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\netbtugc.exe 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\sdiagnhost.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\stordiag.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\typeperf.exe 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ieUnatt.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\iscsicli.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\mavinject.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\mcbuilder.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\relog.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Fondue.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\icsunattend.exe 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\choice.exe 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\net.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\prevhost.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ROUTE.EXE- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\xcopy.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\clip.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\control.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\iscsicpl.exe 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\mcbuilder.exe 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\takeown.exe 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\upnpcont.exe 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\certreq.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\chcp.com 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cmd.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cttune.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\curl.exe 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\dcomcnfg.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\RmClient.exe 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\sdchange.exe 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cliconfg.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\edpnotify.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\extrac32.exe 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\resmon.exe 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\tar.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Com\comrepl.exe 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cscript.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\dxdiag.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Fondue.exe 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\more.com 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\fltMC.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\secinit.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wusa.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\newdev.exe 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\rrinstaller.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\tree.com- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\dtdump.exe 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\fontview.exe 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\dllhost.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\findstr.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\sfc.exe 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\tree.com 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\AtBroker.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\autochk.exe 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe -
resource yara_rule behavioral2/memory/4320-0-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/files/0x00090000000293eb-5.dat upx behavioral2/memory/4320-982-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/4320-985-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/4320-1745-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/4320-2362-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/4320-3175-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/4320-3176-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/4320-3180-0x0000000000400000-0x000000000040F000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{CA565693-D2C5-4BF5-BC9E-F82435F8187A}\MicrosoftEdge_X64_139.0.3405.125.exe 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Mozilla Firefox\firefox.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Media Player\wmprph.exe 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateOnDemand.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateBroker.exe 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\elevation_service.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.exe 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\7-Zip\7zG.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows NT\Accessories\wordpad.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-wab-app_31bf3856ad364e35_10.0.22000.1_none_98ecfb26dc5bb1d2\wabmig.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-runonce_31bf3856ad364e35_10.0.22000.1_none_76531c94f831c76b\runonce.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_msbuild_b03f5f7f11d50a3a_4.0.15806.0_none_0607cd955dab15ad\MSBuild.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..biometrics-trustlet_31bf3856ad364e35_10.0.22000.469_none_40856ba085a100c4\f\BioIso.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-credwiz_31bf3856ad364e35_10.0.22000.1_none_f61e4e51709e31f8\credwiz.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..raries-servercommon_31bf3856ad364e35_10.0.22000.1_none_ffcf293574d7aaf5\appcmd.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-optionaltsps_31bf3856ad364e35_10.0.22000.1_none_383fdbeacdabdb26\tcmsetup.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.493_none_81cdab704eaad423\n\MiniSearchHost.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wusa_31bf3856ad364e35_10.0.22000.1_none_0d98d97551c6b097\wusa.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.22000.282_none_d037578ed2162e06\f\sdbinst.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.22000.100_none_f82676266a17f522\UevTemplateBaselineGenerator.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ebviewhost.appxmain_31bf3856ad364e35_10.0.22000.120_none_05dfd9bc9f8bc6b6\f\Win32WebViewHost.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-calc_31bf3856ad364e35_10.0.22000.1_none_0a56493353e5cd68\calc.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-eventlog-commandline_31bf3856ad364e35_10.0.22000.65_none_ad3d2613cd22d055\f\wevtutil.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\x86_netfx4-vbc_exe_b03f5f7f11d50a3a_4.0.15806.0_none_de9c072f19e4a666\vbc.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-setup-support_31bf3856ad364e35_11.0.22000.348_none_04e0603a0d245e07\ie4uinit.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp_31bf3856ad364e35_10.0.22000.493_none_157ddf72a65679bf\f\sppsvc.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_netfx35linq-csharp_31bf3856ad364e35_10.0.22000.1_none_6d6f4cb018f2ec3c\csc.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-p..ntalcontrolsmonitor_31bf3856ad364e35_10.0.22000.65_none_2d03a3ca59967a09\f\WpcMon.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.22000.1_none_3af3f70bfdcd4fb1\query.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.318_none_82292a5c4e657627\r\SearchHost.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.22000.1_none_ddb5359fa07e69e6\print.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_10.0.22000.1_none_0e8c117a0fb4af58\unregmp2.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ng-server-isolation_31bf3856ad364e35_10.0.22000.1_none_f2f2b094636b4172\PrintIsolationHost.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lications-clientsku_31bf3856ad364e35_10.0.22000.282_none_1a017429cb7fea2c\r\rdpshell.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_multipoint-logcollector_31bf3856ad364e35_10.0.22000.1_none_f6661d429feb51c4\LogCollector.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.22000.348_none_75b35e16f6608fe4\r\WerFault.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..-commandline-dsmgmt_31bf3856ad364e35_10.0.22000.434_none_ea163a1fcbc61cc7\f\dsmgmt.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\x86_microsoft-windows-s..or-native-serverbox_31bf3856ad364e35_10.0.22000.120_none_0f0554e930e1de1c\RMActivate_ssp.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\IEExec.exe 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_comsvcconfig_b03f5f7f11d50a3a_4.0.15806.0_none_468f0244bfc28b69\ComSvcConfig.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-host-service_31bf3856ad364e35_10.0.22000.318_none_f32072a930d121b3\r\vmcompute.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.22000.348_none_6b5eb3c4c1ffcde9\WerFault.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lipboardredirection_31bf3856ad364e35_10.0.22000.376_none_fd0b376d9072c88a\rdpclip.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-findstr_31bf3856ad364e35_10.0.22000.1_none_87c7d35a92de7cef\findstr.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-registry-editor_31bf3856ad364e35_10.0.22000.1_none_54c6fd5d15027c02\regedt32.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.22000.376_none_a359e3d81485694b\f\MsSense.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-i..sermode-kernel-la57_31bf3856ad364e35_10.0.22000.71_none_cd21d839939807f0\f\securekernella57.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ndation-frameserver_31bf3856ad364e35_10.0.22000.469_none_b104ba5249e06dec\FsIso.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_10.0.22000.71_none_688486d306b27285\msinfo32.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pktmon-setup_31bf3856ad364e35_10.0.22000.318_none_4f645f5d22dc7176\PktMon.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ter-cimprovider-exe_31bf3856ad364e35_10.0.22000.1_none_b98d3baff0bf243b\Register-CimProvider.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-fontview_31bf3856ad364e35_10.0.22000.1_none_a4fc5537efa0db6f\fontview.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.22000.71_none_8e1bee8f157fdd6d\f\msinfo32.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-externaldictionary_31bf3856ad364e35_10.0.22000.1_none_92df2755bd6849fd\IMEWDBLD.EXE- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..services-core-files_31bf3856ad364e35_10.0.22000.318_none_8b633995ac1a50de\dsamain.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.22000.132_none_e66ce03b0132db6b\ResetEngine.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_aspnet_regsql_b03f5f7f11d50a3a_4.0.15806.0_none_d4aecc3168a74ea1\aspnet_regsql.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.22000.348_none_75b35e16f6608fe4\WerFaultSecure.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.22000.1_none_c1bbc2c937fef3c3\typeperf.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..snotificationbroker_31bf3856ad364e35_10.0.22000.37_none_46638c67a45b1942\r\MusNotification.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wusa_31bf3856ad364e35_10.0.22000.1_none_03442f231d65ee9c\wusa.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.22000.120_none_3d11f25cbb74100a\r\sdchange.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\PrintDialog\PrintDialog.exe 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SystemApps\Windows.CBSPreview_cw5n1h2txyewy\CameraBarcodeScannerPreview.exe 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-iechooser_31bf3856ad364e35_11.0.22000.1_none_7aae2e8869defcb3\IEChooser.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_state.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\OOBENetworkConnectionFlow.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ork-uimanagerbroker_31bf3856ad364e35_10.0.22000.1_none_d055cf65af7c4d30\UIMgrBroker.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wrp-integrity-client_31bf3856ad364e35_10.0.22000.120_none_30f8a86da4d47388\r\sfc.exe- 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-19_ffa3c0099df3a8ca56fd882f75602b31_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4320
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 7.8MB
- SHA256 c249cb3421f8afb4ae90529691b1771709c5aef0885fbbfbca7687b422a5c5df
- MD5 43d3f3781ef2dc5172e05061702a4e65
- SHA1 7c4ad57efe9547372725d6417b1ae328ce659b28
- SHA512 d4cc48ef9111ed39e3585f330be9f656dc33bbafa5649d26a97e1b607a6f00c6f22f99d74c0c30f479434c9b429327f6d781dca4d085ac2d04896c6d237b3dda
- SSDEEP 98304:lhpBinjOykGcPdOR5fd0oAaldmdmnphdBRQjo9joQ:TpAnjOyAdOrfyKmd0jdB4o5oQ
- TLSH T1B6869D02F29442B6D0A3D075C9969725DB713C690BB1D2EB3384B6D93E33BD17A3A721
- MD5 SHA1 SHA512 SSDEEP TLSH