Analysis
- max time kernel
149s - max time network
95s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
20/04/2026, 06:03
Behavioral task
behavioral1
Sample
2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
- Size 10.2MB
- Sample260420-gr18naev6w
- SHA256 f56a0b85169f2e3638aa29a3502ddeb58eb9a12d283cc49818327d0ec00bf804
- MD5 0dc714535b0c740da422768083cb076a
- SHA1 8a374b6712bc5ccc202cffc045f8956315eb0371
- SHA512 908bf2836aa92f03d798d165c5b9d97ca331a9cb436bcad863f042b4499e555cf3ed1142a35e646f60d57f01496db3ada5fec06f4ede606f3cf232d0ec566ce1
- SSDEEP 98304:lhpBinjOykGcPdOR5NTIOSAkdvjozRH3DgdiLapI0dF:TpAnjOyAdOrNTfgd7ozN3cdicI0dF
- TLSH T104B67C1273940676E0B7917AC8A54A25D7713C2A4BB1C3DF3244B6DE1E737C1AA3B722
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral2/files/0x002700000002b11c-5.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral2/files/0x002700000002b11c-5.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule behavioral2/files/0x002700000002b11c-5.dat UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\TapiUnattend.exe 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\appidtel.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\icacls.exe 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\rasphone.exe 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\comp.exe 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\dfrgui.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\MuiUnattend.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\sxstrace.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\msiexec.exe 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\msinfo32.exe 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Netplwiz.exe 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\regedt32.exe 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\RmClient.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Robocopy.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\hh.exe 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ipconfig.exe 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\sdchange.exe 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Windows.WARP.JITService.exe 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Fondue.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\systray.exe 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\regedit.exe 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\certreq.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ieUnatt.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\netbtugc.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\PickerHost.exe 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\unregmp2.exe 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\dfrgui.exe 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\dpnsvr.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\at.exe 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\DpiScaling.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\fsutil.exe 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\mountvol.exe 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\raserver.exe 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ReAgentc.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SecEdit.exe 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\bthudtask.exe 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cleanmgr.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cmdkey.exe 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\runonce.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wusa.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ddodiag.exe 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\DpiScaling.exe 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SearchIndexer.exe 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\verclsid.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\MRINFO.EXE- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\net1.exe 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\eventcreate.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\label.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\charmap.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\iscsicpl.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\PATHPING.EXE- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\recover.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\RMActivate.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ReAgentc.exe 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe -
resource yara_rule behavioral2/memory/1728-0-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/files/0x002700000002b11c-5.dat upx behavioral2/memory/1728-695-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/1728-694-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/1728-1397-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/1728-1846-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/1728-2613-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/1728-3176-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/1728-3177-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/1728-3181-0x0000000000400000-0x000000000040F000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\dotnet\dotnet.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Internet Explorer\ieinstal.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateCore.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Internet Explorer\ielowutil.exe 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\7-Zip\Uninstall.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.22000.318_none_9b6af6ae8c0ac6cb\f\dtdump.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..hreshold-adminflows_31bf3856ad364e35_10.0.22000.100_none_1c26ef58a3003bf2\f\SystemSettingsAdminFlows.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-nltest_31bf3856ad364e35_10.0.22000.318_none_95d72c738176ed2a\f\nltest.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.493_none_81cdab704eaad423\SearchHost.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-netsh_31bf3856ad364e35_10.0.22000.1_none_c0393e363102a7bd\netsh.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-uevservice_31bf3856ad364e35_10.0.22000.100_none_791efb09af53b896\AgentService.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.22000.469_none_5669b3acf1ecab58\f\winresume.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-csvde_31bf3856ad364e35_10.0.22000.1_none_b181c8fde74dcdf7\csvde.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mapi_31bf3856ad364e35_10.0.22000.120_none_a6b2722d9eed2eed\r\fixmapi.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.22000.318_none_2da4853532607174\AuditShD.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-robocopy_31bf3856ad364e35_10.0.22000.469_none_cc9ed34da60ac9c4\f\Robocopy.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ntalcontrolsmonitor_31bf3856ad364e35_10.0.22000.65_none_2d03a3ca59967a09\r\WpcMon.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..pertiescomputername_31bf3856ad364e35_10.0.22000.1_none_86b6cff74107116e\SystemPropertiesComputerName.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.318_none_82292a5c4e657627\ScreenClippingHost.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_netfx-jsc_b03f5f7f11d50a3a_10.0.22000.1_none_dd296e21b988f15c\jsc.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.22000.71_none_ccb71d3ee4c7b8a6\ByteCodeGenerator.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\x86_netfx-aspnet_wp_exe_b03f5f7f11d50a3a_10.0.22000.1_none_61b2a98c4ae7f0f2\aspnet_wp.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Workflow.Compiler.exe 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-shell-shellappruntime_31bf3856ad364e35_10.0.22000.469_none_0defc0f5807dd5f0\f\ShellAppRuntime.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-netbt_31bf3856ad364e35_10.0.22000.1_none_c0fd105a306dfcd0\netbtugc.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ComSvcConfig.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.22000.376_none_c7a79de54d7799ec\f\AppVDllSurrogate.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-commandline-dsmgmt_31bf3856ad364e35_10.0.22000.434_none_4634d5a384238dfd\f\dsmgmt.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..riseclientsync-host_31bf3856ad364e35_10.0.22000.100_none_c98e4ba1fbb1ffd8\WorkFolders.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-net-command-line-tool_31bf3856ad364e35_10.0.22000.1_none_b2ca9978aba0e546\net.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.22000.376_none_d180c9ec46d962eb\f\spoolsv.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.22000.318_none_8e5804ec62c5891c\cmproxyd.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-gdi_31bf3856ad364e35_10.0.22000.132_none_a52f79fedfba2bb3\fontdrvhost.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..switch-toasthandler_31bf3856ad364e35_10.0.22000.37_none_ac96ecb2523a6a01\InputSwitchToastHandler.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..-management-console_31bf3856ad364e35_10.0.22000.1_none_65b6e8b67a6b522a\mmc.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-robocopy_31bf3856ad364e35_10.0.22000.469_none_c24a28fb71aa07c9\Robocopy.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rpc-locator_31bf3856ad364e35_10.0.22000.1_none_257830d2f16108b0\Locator.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-consumers_31bf3856ad364e35_10.0.22000.1_none_a115c50e5daa7435\scrcons.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regbrowsers.exe 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..n-tools-command-ldp_31bf3856ad364e35_10.0.22000.434_none_4a9fb8788572dd19\ldp.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-parentalcontrols-ots_31bf3856ad364e35_10.0.22000.37_none_7461fc8593f740b9\ApproveChildRequest.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-ksetup_31bf3856ad364e35_10.0.22000.1_none_72b0643452f173af\ksetup.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core-providerhost_31bf3856ad364e35_10.0.22000.1_none_66a65c31902e1d37\WmiPrvSE.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_jsc_b03f5f7f11d50a3a_4.0.15806.0_none_2ca8c9f483ea58df\jsc.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_wp.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-healthattestation-csp_31bf3856ad364e35_10.0.22000.469_none_265cec8f409ba4eb\r\HealthAttestationClientAgent.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.318_none_82292a5c4e657627\r\WebExperienceHostApp.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-chkdsk_31bf3856ad364e35_10.0.22000.1_none_1829f78691799100\chkdsk.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-packagemanager_31bf3856ad364e35_10.0.22000.120_none_e83cf4fa7871c56f\PkgMgr.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-trustedinstaller_31bf3856ad364e35_10.0.22000.282_none_8c338754d2830d3e\r\TrustedInstaller.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.22000.282_none_c58bc93032642398\WSManHTTPConfig.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.22000.282_none_d037578ed2162e06\r\sdbinst.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-net1-command-line-tool_31bf3856ad364e35_10.0.22000.1_none_dd1f9117595c3dbe\net1.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.280_none_0483b4854ca89ef9\TiWorker.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-starttiledata_31bf3856ad364e35_10.0.22000.348_none_8c1cd5f65f938380\r\DataStoreCacheDumpTool.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dfsvc.exe 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..iondata-cmdlinetool_31bf3856ad364e35_10.0.22000.376_none_836023902a7c3e20\bcdedit.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-calc_31bf3856ad364e35_10.0.22000.1_none_00019ee11f850b6d\calc.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..anagement-dmomacpmo_31bf3856ad364e35_10.0.22000.1_none_25bddf72f687f255\DmOmaCpMo.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fodhelper-ux_31bf3856ad364e35_10.0.22000.71_none_152ef1c98c20fad4\f\fodhelper.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-easinvoker_31bf3856ad364e35_10.0.22000.1_none_e267df21b2c3a4b4\easinvoker.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.22000.1_none_890a915053a73623\NETSTAT.EXE- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-d..s-vmswitch-netsetup_31bf3856ad364e35_10.0.22000.318_none_7fdfd2b2e06a7af9\r\nvspinfo.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.22000.318_none_569ec118f1c50925\winload.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-runlegacycplelevated_31bf3856ad364e35_10.0.22000.1_none_674facc3fa15e905\RunLegacyCPLElevated.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.22000.1_none_3af3f70bfdcd4fb1\logoff.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wifinetworkmanager_31bf3856ad364e35_10.0.22000.37_none_4ebd7bd997a97fcb\wifitask.exe- 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1728
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 10.7MB
- SHA256 f8695fc2e35ba5c001953d6ac38b4099202436cd9c13a1fffc65b9406692f7a9
- MD5 16e31bc571a98527692c1b1d39e0f34c
- SHA1 2be0a8c86a205d5ab0c0aaed15d68c6e54aee290
- SHA512 00111f02c8c4ca35104526bb048a503a9d6c5061f1c8b956cbce536f827c5d32a71cf711d450edfda9b39f69d267c067287a1c42e8363008e652b18149f0dd33
- SSDEEP 98304:lhpBinjOykGcPdOR5NTIOSAkdvjozRH3DgdiLapI0dBjoP:TpAnjOyAdOrNTfgd7ozN3cdicI0dFoP
- TLSH T150B68D12B3A40276E0B79179C4A55629D7713C2A4BB1C3CF3244B6DD2E737D1AA3B722
- MD5 SHA1 SHA512 SSDEEP TLSH