Analysis
- max time kernel
149s - max time network
95s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
20/04/2026, 04:32
Behavioral task
behavioral1
Sample
2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
- Size 7.8MB
- Sample260420-e55rwsg12j
- SHA256 bfbcae9b6ac9248b5dc4d4867d92e63a02f6a36a6ebd9120f0022d1a3a07050a
- MD5 0112fd8991baa8b782465a2e9d6f1873
- SHA1 94eda9a055e1b8c81f762626950e98974a5eb62f
- SHA512 2f07cf409f9a9328bef51cd579e1b7aa1ee981eab60002926ceb5ebbb47f2d1332ec37e575059f06c2ddd41d6b2591c73ea02ed2487792351f9a0bc4b3641af5
- SSDEEP 98304:ShpBinjOykGcIBdAWQtZ/K0tGOFWVRuQHD5fkZcp:WpAnjOynBdAWyZ/K0ttYVAQHhPp
- TLSH T197868D16F2A44376D0B3D0B9C6DAA756EA3234551B30D6CF2384B7692E33BD1863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule behavioral2/files/0x000600000002a7e0-5.dat UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\control.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\net1.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\openfiles.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\setup16.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cmdkey.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Fondue.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\regini.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\shrpubw.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wsmprovhost.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\regedt32.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\rundll32.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\taskkill.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\gpupdate.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wecutil.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wowreg32.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ntprint.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\replace.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\tzutil.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Utilman.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\winrm.cmd- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\diskusage.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\PING.EXE- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\w32tm.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ddodiag.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\getmac.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\net1.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\rekeywiz.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\tttracer.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wecutil.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\find.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ieUnatt.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\netbtugc.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\logman.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SecEdit.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cttune.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\icsunattend.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SearchIndexer.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\srdelayed.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\systray.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\userinit.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\gpscript.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\grpconv.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\makecab.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\mode.com 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\odbcad32.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\PkgMgr.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\subst.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SyncHost.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\diskperf.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\explorer.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\getmac.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\logman.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe -
resource yara_rule behavioral2/memory/3344-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/files/0x000600000002a7e0-5.dat upx behavioral2/memory/3344-835-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/3344-3189-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateOnDemand.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\dotnet\dotnet.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\elevation_service.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\show_third_party_software_licenses.bat 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Windows Media Player\wmlaunch.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Windows Media Player\wmpshare.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Mozilla Firefox\firefox.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Internet Explorer\ExtExport.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Media Player\wmprph.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-clientcmdtools_31bf3856ad364e35_10.0.22000.1_none_a7a700c8f53b4106\umount.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-autochk_31bf3856ad364e35_10.0.22000.1_none_428c3541faeaf85a\autochk.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shellhost_31bf3856ad364e35_10.0.22000.1_none_6cbbdad227c57e28\sihost.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.22000.282_none_c58bc93032642398\winrm.cmd- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet_wp_exe_b03f5f7f11d50a3a_10.0.22000.1_none_1a0572b5366bc7ec\aspnet_wp.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-t..-remoteapplications_31bf3856ad364e35_10.0.22000.282_none_3d368ddb21bde8c7\f\rdpinit.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-volumecontrol_31bf3856ad364e35_10.0.22000.100_none_c1a3421d8c97478a\f\SndVol.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filehistory-core_31bf3856ad364e35_10.0.22000.71_none_974c497c92a1fd89\f\fhmanagew.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lsa-minwin_31bf3856ad364e35_10.0.22000.434_none_38ca096a17805fa9\r\lsass.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.22000.1_none_f24d5bd1a5bd0380\resmon.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.22000.1_none_810efa0e3f0e1154\wermgr.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..opertiesperformance_31bf3856ad364e35_10.0.22000.1_none_bb6ef5283c041299\SystemPropertiesPerformance.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-trustedinstaller_31bf3856ad364e35_10.0.22000.469_none_8c502cfed26c810b\f\TrustedInstaller.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-fsutil_31bf3856ad364e35_10.0.22000.282_none_d1df129ba9a9b56f\f\fsutil.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-gdi_31bf3856ad364e35_10.0.22000.348_none_a52aaf9adfbcd9fc\f\fontdrvhost.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-grouppolicy-script_31bf3856ad364e35_10.0.22000.1_none_bb5ad6287475565d\gpscript.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..nt-enrollmenthelper_31bf3856ad364e35_10.0.22000.41_none_1d0a15319901359b\PinEnrollmentBroker.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-more_31bf3856ad364e35_10.0.22000.1_none_0cf29863523884a8\more.com- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_regasm_b03f5f7f11d50a3a_4.0.15806.0_none_9be8d99ac1f7c734\RegAsm.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\ImmersiveControlPanel\SystemSettings.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.22000.71_none_8e1bee8f157fdd6d\f\msinfo32.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dispdiag_31bf3856ad364e35_10.0.22000.1_none_9b2806fb34e0407f\dispdiag.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-usoclient_31bf3856ad364e35_10.0.22000.282_none_aa0f0c4e1a1cb43f\r\UsoClient.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.22000.282_none_75821ac4f6866a77\WerFault.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_11.0.22000.120_none_e2284b7d90c8a180\f\iexplore.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.22000.376_none_2d61a5193292e66c\f\AuditShD.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.22000.348_none_75b35e16f6608fe4\f\WerFaultSecure.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.22000.318_none_c7ea7e014d4524f4\AppVStreamingUX.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-acluifilefoldercomtool_31bf3856ad364e35_10.0.22000.1_none_ae92c24e0a04e0bb\cacls.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.22000.318_none_8e5804ec62c5891c\r\cmimageworker.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-robocopy_31bf3856ad364e35_10.0.22000.469_none_c24a28fb71aa07c9\f\Robocopy.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..monotificationuxexe_31bf3856ad364e35_10.0.22000.282_none_618940d4a376d501\MoNotificationUx.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.22000.348_none_75b35e16f6608fe4\r\WerFaultSecure.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.22000.469_none_71e2bda169e58aea\r\audiodg.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bioenrollment.appxmain_31bf3856ad364e35_10.0.22000.120_none_fbcb84a27b36694e\r\BioEnrollmentHost.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_vmconnect6.3_31bf3856ad364e35_10.0.22000.1_none_fc9d677d21300587\vmconnect6.3.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tapisetup_31bf3856ad364e35_10.0.22000.1_none_ca8b72bbd453db4c\TapiUnattend.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Workflow.Compiler.exe 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_windowssearchengine_31bf3856ad364e35_7.0.22000.348_none_5519d2fa88b436fc\f\SearchFilterHost.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\x86_microsoft-windows-d..ommandline-repadmin_31bf3856ad364e35_10.0.22000.434_none_a003f3391feff8a5\f\repadmin.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.22000.282_none_d037578ed2162e06\f\sdbinst.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-setup-support_31bf3856ad364e35_11.0.22000.348_none_04e0603a0d245e07\ie4ushowIE.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..client-decoder-host_31bf3856ad364e35_10.0.22000.318_none_1e08617dd1895eb7\UtcDecoderHost.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userinit_31bf3856ad364e35_10.0.22000.37_none_be275aadedb23f4a\f\userinit.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.22000.348_none_7c4c059b9e36fe85\f\SpatialAudioLicenseSrv.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.22000.65_none_9b4fcb543bd21a13\f\LaunchTM.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.22000.318_none_c7ea7e014d4524f4\r\AppVStreamingUX.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp_31bf3856ad364e35_10.0.22000.318_none_15d95e5ea6111bc3\sppsvc.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.22000.1_none_ddb5359fa07e69e6\print.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-twinui_31bf3856ad364e35_10.0.22000.493_none_7918a9fd73257276\f\LaunchWinApp.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmwp_31bf3856ad364e35_10.0.22000.282_none_3066e216e524ffb4\r\vmwp.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.22000.194_none_15db8cfb1c6a6b33\SystemSettings.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-unlock_31bf3856ad364e35_10.0.22000.1_none_bad94eac3141fbc7\bdeunlock.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-synchost_31bf3856ad364e35_10.0.22000.1_none_bfc4aabf015b7a53\SyncHost.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_netfx35linq-addinutil_31bf3856ad364e35_10.0.22000.1_none_2161d6cde824ee93\AddInUtil.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-expand_31bf3856ad364e35_10.0.22000.1_none_b90ac474910a4673\expand.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..switch-toasthandler_31bf3856ad364e35_10.0.22000.37_none_b6eb9704869b2bfc\InputSwitchToastHandler.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-legacyhwui_31bf3856ad364e35_10.0.22000.1_none_430c6a5b816abeb9\hdwwiz.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-mapi_31bf3856ad364e35_10.0.22000.120_none_b1071c7fd34df0e8\f\fixmapi.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-disksnapshot_31bf3856ad364e35_10.0.22000.1_none_d6935f7d69086fe5\DiskSnapshot.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eventlog-commandline_31bf3856ad364e35_10.0.22000.65_none_a2e87bc198c20e5a\wevtutil.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..spaces-spacemanager_31bf3856ad364e35_10.0.22000.1_none_a061a9a7af162f02\spaceman.exe- 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-20_0112fd8991baa8b782465a2e9d6f1873_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3344
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 8.3MB
- SHA256 0946c087e0cb34d6164f19913c65a499a2c0b783421b2aafd210df166800a14b
- MD5 567626deda7e16c951c7afedb896f77e
- SHA1 14b3f940c5b194fef93c7bd0ac2d0d0de97c5358
- SHA512 98a87939b5f733a605d978c231dc84edcf2e077bcc2e872ef19e22b9353b0b13f56521278493b99c7d17f42ff108bd79a6150480dc10bbe14ca3ddbcdff659f5
- SSDEEP 98304:ShpBinjOykGcIBdAWQtZ/K0tGOFWVRuQHD5fkZc9jom:WpAnjOynBdAWyZ/K0ttYVAQHhP5om
- TLSH T10F968D16F2A44376D0B3C0B9C6D6A756EA3234551B30D6CB2385F7692E33BE1863A731
- MD5 SHA1 SHA512 SSDEEP TLSH