Analysis
- max time kernel
149s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
20/04/2026, 04:32
Behavioral task
behavioral1
Sample
2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
- Size 7.8MB
- Sample260420-e55rwsg12j
- SHA256 bfbcae9b6ac9248b5dc4d4867d92e63a02f6a36a6ebd9120f0022d1a3a07050a
- MD5 0112fd8991baa8b782465a2e9d6f1873
- SHA1 94eda9a055e1b8c81f762626950e98974a5eb62f
- SHA512 2f07cf409f9a9328bef51cd579e1b7aa1ee981eab60002926ceb5ebbb47f2d1332ec37e575059f06c2ddd41d6b2591c73ea02ed2487792351f9a0bc4b3641af5
- SSDEEP 98304:ShpBinjOykGcIBdAWQtZ/K0tGOFWVRuQHD5fkZcp:WpAnjOynBdAWyZ/K0ttYVAQHhPp
- TLSH T197868D16F2A44376D0B3D0B9C6DAA756EA3234551B30D6CF2384B7692E33BD1863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule behavioral1/files/0x000a00000002166e-5.dat UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Robocopy.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\bootcfg.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cliconfg.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cmdkey.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\gpresult.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\msinfo32.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Speech_OneCore\Common\SpeechModelDownload.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cacls.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\fsutil.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\grpconv.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\user.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\NETSTAT.EXE 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\tttracer.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ARP.EXE- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\convert.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\dplaysvr.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\find.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\makecab.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\mshta.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\RmClient.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\timeout.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\doskey.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\msiexec.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\rasautou.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Robocopy.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\systray.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cmd.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\dialer.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\esentutl.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\compact.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\fltMC.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\nslookup.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\regsvr32.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\fontview.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ntprint.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\RdpSa.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wiaacmgr.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cttunesvr.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\DpiScaling.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\newdev.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\resmon.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\takeown.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\autochk.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\DpiScaling.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\rasautou.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\taskkill.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\dpapimig.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\mtstocom.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\powercfg.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\rrinstaller.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\sdchange.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\setx.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe -
resource yara_rule behavioral1/memory/4880-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/files/0x000a00000002166e-5.dat upx behavioral1/memory/4880-674-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/4880-3200-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Windows Media Player\wmplayer.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Windows Mail\wab.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Internet Explorer\iexplore.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Internet Explorer\iexplore.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Mozilla Firefox\updater.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\uninstall.cmd 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\7-Zip\7zG.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.84_none_a689f818199cbaf8\LaunchTM.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-iechooser_31bf3856ad364e35_11.0.19041.1_none_da5b9e6604736fbe\IEChooser.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-commandprompt_31bf3856ad364e35_10.0.19041.746_none_735abbdbad8c902f\f\cmd.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-explorer_31bf3856ad364e35_10.0.19041.1266_none_d0cf24ea634e86e3\r\explorer.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.19041.1266_none_14b8c34dbc1df417\runexehelper.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-optionaltsps_31bf3856ad364e35_10.0.19041.1_none_a241f61a9ca1102c\tcmsetup.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\HelpPane.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallUtil.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SystemApps\Microsoft.AsyncTextService_8wekyb3d8bbwe\Microsoft.AsyncTextService.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-commandline-dsmgmt_31bf3856ad364e35_10.0.19041.1_none_00c77b5a9e4f1bee\dsmgmt.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..lity-eoaexperiences_31bf3856ad364e35_10.0.19041.746_none_c291aefd01a5d6d6\EoAExperiences.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..alenrollmentmanager_31bf3856ad364e35_10.0.19041.1202_none_1a780ff3456b7bcd\f\CredentialEnrollmentManager.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-defrag-cmdline_31bf3856ad364e35_10.0.19041.746_none_a5751a882524bee1\r\Defrag.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..ing-management-core_31bf3856ad364e35_10.0.19041.746_none_ad0ed54dd130eec3\f\DismHost.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\x86_microsoft-windows-photoscreensaver_31bf3856ad364e35_10.0.19041.746_none_eda92e20fee7d318\f\PhotoScreensaver.scr- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1_none_bf506ecc66a800df\TiFileFetcher.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wininit_31bf3856ad364e35_10.0.19041.1_none_e6e3c652a3ae2d1d\wininit.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_10.0.19041.1_none_ad76f6bb45d8f232\IMJPDCT.EXE- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-bash_31bf3856ad364e35_10.0.19041.117_none_1db60e061b48335a\r\bash.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filepicker.appxmain_31bf3856ad364e35_10.0.19041.1023_none_374973298940e35c\r\FilePicker.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unp_31bf3856ad364e35_10.0.19041.1266_none_21c0be7c0dad3632\r\UNPUXLauncher.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_netfx-dfsvc_b03f5f7f11d50a3a_10.0.19041.1_none_833d086e8f306c45\dfsvc.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-cloudnotifications_31bf3856ad364e35_10.0.19041.746_none_7a559100246cff2b\CloudNotifications.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lua_31bf3856ad364e35_10.0.19041.746_none_8443a7febb9ab03d\r\consent.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..s-datausagehandlers_31bf3856ad364e35_10.0.19041.153_none_dbdeec75cdd2a4d1\f\DataUsageLiveTileTask.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winlogon_31bf3856ad364e35_10.0.19041.1266_none_e488d49c8a22d21e\r\winlogon.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.19041.1288_none_1cec63974464878f\SenseSC.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-hns-diagnosticstool_31bf3856ad364e35_10.0.19041.423_none_841c30f68571c385\r\hnsdiag.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bioenrollment.appxmain_31bf3856ad364e35_10.0.19041.844_none_de5d9fe254d9f8c4\f\BioEnrollmentHost.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-aarsvc_31bf3856ad364e35_10.0.19041.264_none_40d14f6c04397868\agentactivationruntimestarter.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft.workflow.compiler_31bf3856ad364e35_4.0.15805.0_none_eb7ee992c51a9917\Microsoft.Workflow.Compiler.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..ing-management-core_31bf3856ad364e35_10.0.19041.746_none_ad0ed54dd130eec3\DismHost.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.264_none_aa5417fd2708544d\f\SyncAppvPublishingServer.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wslconfig_31bf3856ad364e35_10.0.19041.117_none_7f3778d7035d9622\r\wslconfig.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoftwindows-undockeddevkit.appxmain_31bf3856ad364e35_10.0.19041.488_none_7201e1dc944d1765\UndockedDevKit.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-taskhost_31bf3856ad364e35_10.0.19041.906_none_066336a1b904a848\f\taskhostw.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-trustedinstaller_31bf3856ad364e35_10.0.19041.1202_none_05cd606e025d0d96\r\TrustedInstaller.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_windows-gaming-xbox..e-service-component_31bf3856ad364e35_10.0.19041.789_none_3136b8d712da0334\r\XblGameSaveTask.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-cpl_31bf3856ad364e35_10.0.19041.1202_none_cc46843e404eb749\BitLockerWizardElev.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_9aa166e99861c2bc\tscon.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.19041.1288_none_1cec63974464878f\r\SenseCE.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.19041.1_none_36e57bfcb85e0850\SpatialAudioLicenseSrv.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\x86_netfx4-aspnet_wp_exe_b03f5f7f11d50a3a_4.0.15805.0_none_5643c883846b0513\aspnet_wp.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\r\AppVDllSurrogate.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-explorer_31bf3856ad364e35_10.0.19041.264_none_2f9647f4d89dc6f5\explorer.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..verycenter-platform_31bf3856ad364e35_10.0.19041.964_none_21209b01f08afd33\SystemResetPlatform.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sensordataservice_31bf3856ad364e35_10.0.19041.746_none_dbfd31e3890afb72\SensorDataService.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..tiondialog.appxmain_31bf3856ad364e35_10.0.19041.1_none_c9f3f831b5b3535d\PinningConfirmationDialog.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiFileFetcher.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-tetheringservice_31bf3856ad364e35_10.0.19041.746_none_6ba9668b45cb4938\r\IcsEntitlementHost.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_ef0e010d1381269b\iisreset.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-runas_31bf3856ad364e35_10.0.19041.1_none_15d956c7fccae922\runas.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sysprep_31bf3856ad364e35_10.0.19041.746_none_cd77eb91574a2623\r\sysprep.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..onwakesettingflyout_31bf3856ad364e35_10.0.19041.1_none_623e57cb80e184b5\PasswordOnWakeSettingFlyout.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wordpad_31bf3856ad364e35_10.0.19041.1_none_ee00310940a3cd37\wordpad.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\EdmGen.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-blb-cli-main_31bf3856ad364e35_10.0.19041.1202_none_c0150a0a443c0ffc\wbadmin.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4880
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 8.3MB
- SHA256 0946c087e0cb34d6164f19913c65a499a2c0b783421b2aafd210df166800a14b
- MD5 567626deda7e16c951c7afedb896f77e
- SHA1 14b3f940c5b194fef93c7bd0ac2d0d0de97c5358
- SHA512 98a87939b5f733a605d978c231dc84edcf2e077bcc2e872ef19e22b9353b0b13f56521278493b99c7d17f42ff108bd79a6150480dc10bbe14ca3ddbcdff659f5
- SSDEEP 98304:ShpBinjOykGcIBdAWQtZ/K0tGOFWVRuQHD5fkZc9jom:WpAnjOynBdAWyZ/K0ttYVAQHhP5om
- TLSH T10F968D16F2A44376D0B3C0B9C6D6A756EA3234551B30D6CB2385F7692E33BE1863A731
- MD5 SHA1 SHA512 SSDEEP TLSH