Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
21/04/2026, 22:34
Behavioral task
behavioral1
Sample
2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe
- Size 9.6MB
- Sample260421-2hb8dsgv7t
- SHA256 97d203fc6c267a105371c25688d17580ea8ee9f1b665839728622c26fca9c5dc
- MD5 e8627252da70299a0f5ce725459be170
- SHA1 9c138d35c2573fa0ff28883d3a6aad6e8dec4e8e
- SHA512 9d35c348251b663ac96347c6eb4d70d0c1a4682bbdcc110eec478283bb85ca94ec53ac1095acb5c5d5e6000f40253ecbcf581eca01537bf84710212b7b1691da
- SSDEEP 98304:lhpBinjOykGcIy6fnUm8UdjoKjog/PvOAjcXvvOOc5Djo6:TpAnjOyny6f18UZoso2HOAoXvvOPo6
- TLSH T19CA68C1EB35842B6D0B3C0B9C9969746E671BC514B3196CF2284B75D2F777E28E3A320
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule behavioral1/files/0x000a00000002275b-5.dat UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\verclsid.exe 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\winrs.exe 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\getmac.exe 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\makecab.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\gpresult.exe 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\autochk.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\ByteCodeGenerator.exe 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\compact.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\LaunchTM.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\cttune.exe 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\Fondue.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\help.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\label.exe 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\net.exe 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\PATHPING.EXE- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\setup16.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\OpenWith.exe 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\user.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\wiaacmgr.exe 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\bitsadmin.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\bitsadmin.exe 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\userinit.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\wecutil.exe 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\getmac.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\hh.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\mfpmp.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\msiexec.exe 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\ReAgentc.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\winrm.cmd- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\comp.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\icacls.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\msinfo32.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\OposHost.exe 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\TapiUnattend.exe 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\winver.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\dccw.exe 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\doskey.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\eudcedit.exe 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\findstr.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\netiougc.exe 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\OneDriveSetup.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\recover.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\Dism.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\esentutl.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\fsutil.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\sethc.exe 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\stordiag.exe 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\wlanext.exe 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\wowreg32.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\cmstp.exe 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\forfiles.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe -
resource yara_rule behavioral1/memory/3668-0-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/files/0x000a00000002275b-5.dat upx behavioral1/memory/3668-604-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/3668-606-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/3668-1294-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/3668-1754-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/3668-2382-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/3668-3078-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/3668-3208-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/3668-3210-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/3668-3216-0x0000000000400000-0x000000000040F000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Windows Media Player\wmlaunch.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\show_third_party_software_licenses.bat 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Common Files\microsoft shared\ink\mip.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Windows Media Player\setup_wm.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Common Files\microsoft shared\ink\mip.exe 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Internet Explorer\iexplore.exe 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Windows Media Player\setup_wm.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-c..alenrollmentmanager_31bf3856ad364e35_10.0.19041.264_none_839983ebef167c68\f\CredentialEnrollmentManager.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager_31bf3856ad364e35_10.0.19041.1202_none_7cdad2e52790705d\r\hvsirdpclient.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..sition-uicomponents_31bf3856ad364e35_10.0.19041.1151_none_4e193eb76ed5f8cb\wiaacmgr.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wsl_31bf3856ad364e35_10.0.19041.117_none_610933d42d963a44\r\wsl.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.19041.1_none_e8b8012dee3ba92e\NETSTAT.EXE- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SystemApps\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\PeopleExperienceHost.exe 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tieringengine_31bf3856ad364e35_10.0.19041.1_none_6568d39003c9a6d5\TieringEngineService.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-autoplay_31bf3856ad364e35_10.0.19041.1_none_db40687413b90853\wmlaunch.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-bash_31bf3856ad364e35_10.0.19041.117_none_1db60e061b48335a\f\bash.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-upnpdevicehost_31bf3856ad364e35_10.0.19041.153_none_9fd3a313935e2396\r\upnpcont.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.19041.1202_none_497a4c9b969ee5eb\f\WSManHTTPConfig.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-aarsvc_31bf3856ad364e35_10.0.19041.1266_none_d7b5820f5a89765b\agentactivationruntimestarter.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-servicing_31bf3856ad364e35_10.0.19041.1237_none_9ad73d125ac89655\bfsvc.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.19041.264_none_8bd2f5fc0c992e06\r\SearchFilterHost.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SystemApps\ParentalControls_cw5n1h2txyewy\WpcUapApp.exe 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-oobe-machine_31bf3856ad364e35_10.0.19041.1266_none_82441dbab862ff6a\f\msoobe.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.19041.1266_none_14b8c34dbc1df417\runexehelper.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-magnify_31bf3856ad364e35_10.0.19041.1266_none_ed4855448241f7e7\r\Magnify.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.19041.1110_none_2afd3bd8e33c2cf2\r\msinfo32.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.19041.264_none_5b8f61a9b1063622\SpeechModelDownload.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..s-regkeys-component_31bf3856ad364e35_10.0.19041.1_none_b07f1d459f7f777b\RDVGHelper.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-recdisc-main_31bf3856ad364e35_10.0.19041.84_none_7c1f17a9e1beaf63\r\recdisc.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..-odbc-administrator_31bf3856ad364e35_10.0.19041.1_none_04959f34117554a3\odbcad32.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-winre-recoverytools_31bf3856ad364e35_10.0.19041.746_none_bd9bc99304595128\ReAgentc.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess.exe 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ieinstal_31bf3856ad364e35_11.0.19041.1_none_d27e617a9bd9c1d3\ieinstal.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoftwindows-undockeddevkit.appxmain_31bf3856ad364e35_10.0.19041.488_none_7201e1dc944d1765\UndockedDevKit.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_netfx-cvtres_for_vc_and_vb_b03f5f7f11d50a3a_10.0.19041.1_none_5efb81c4b092852b\cvtres.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-extcom_31bf3856ad364e35_10.0.19041.84_none_027c502c6e331223\f\SppExtComObj.Exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mspaint_31bf3856ad364e35_10.0.19041.1_none_4e633e7ac2500190\mspaint.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_hyperv-vmsp_31bf3856ad364e35_10.0.19041.1_none_39d506065bd87607\vmsp.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appid_31bf3856ad364e35_10.0.19041.1202_none_cc0c3d35675da3a1\r\appidcertstorecheck.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-dtc-runtime_31bf3856ad364e35_10.0.19041.1_none_cf441068ff6081fd\msdtc.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasclienttools_31bf3856ad364e35_10.0.19041.1_none_2537dd4c480ec91b\rasphone.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_adobe-flash-for-windows_31bf3856ad364e35_10.0.19041.82_none_2dad4b68cbfd8794\FlashPlayerApp.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.19041.1266_none_8a8440f738abd1b9\r\wmpshare.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..ices-appcompattools_31bf3856ad364e35_10.0.19041.1_none_b36547673f7cb25f\USRLOGON.CMD- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wow64-legacy_31bf3856ad364e35_10.0.19041.1023_none_6aeab5d4bd0371a8\instnm.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-host-service_31bf3856ad364e35_10.0.19041.264_none_d58a0ca50a94510c\f\vmcompute.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..-network-management_31bf3856ad364e35_10.0.19041.1_none_7a53549f2797bc70\nmbind.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msconfig-exe_31bf3856ad364e35_10.0.19041.1_none_906b4c073d1d970c\msconfig.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.19041.1151_none_ec390bd802a1c630\f\SearchIndexer.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..d-searchintegration_31bf3856ad364e35_10.0.19041.746_none_6e05a6bb2291b4c6\f\IMESEARCH.EXE- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-xbox-gameoverlay_31bf3856ad364e35_10.0.19041.1_none_fefb8187fb0ed9be\GamePanel.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1151_none_71aa7fdbb41824a0\ShellExperienceHost.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-takeown_31bf3856ad364e35_10.0.19041.1_none_afdc734db4fba076\takeown.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..dateclient-api-host_31bf3856ad364e35_10.0.19041.1_none_55c691f63ac916c4\wuapihost.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-axinstallservice_31bf3856ad364e35_10.0.19041.867_none_b4e9fc09cfcbdd7c\AxInstUI.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-browser-brokers_31bf3856ad364e35_11.0.19041.746_none_581ccf386ba57d51\browserexport.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vssservice_31bf3856ad364e35_10.0.19041.1_none_10bddbfab734fa42\VSSVC.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.19041.1288_none_3f2d1be96237886e\r\wsmprovhost.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-webcamexperience_31bf3856ad364e35_10.0.19041.1_none_2d2e881f7f8c5f63\CameraSettingsUIHost.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_10.0.19041.746_none_56f2f7338735a9a6\f\WFS.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..tnet-mua-hostserver_31bf3856ad364e35_10.0.19041.746_none_aee92417063babbe\r\WinRTNetMUAHostServer.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_49716c2392052aca\typeperf.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.19041.1_none_9613f8b833f2e8f1\ByteCodeGenerator.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.423_none_72535ca9b59a9515\f\NarratorQuickStart.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-narrator_31bf3856ad364e35_10.0.19041.84_none_b5c0f628d1d661eb\r\Narrator.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\bfsvc.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SystemApps\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\PeopleExperienceHost.exe- 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-21_e8627252da70299a0f5ce725459be170_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3668
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 10.2MB
- SHA256 436bb9d033ef9d358faaa00430add9b6e6f360a09877806b87e83f5bb8e6a680
- MD5 0e03ef429f64b255a7a0d6bcc4b8be51
- SHA1 0a7d25663d5c4106f021f73de4bb1c9b9176e3ce
- SHA512 8efab8950479079e45e35595d440ccff737c0d72e7eef1c59840c53bf215feba664e975034f827eb1ff8f55d069f818e69d2616d0a35e9869fc02488b81a889f
- SSDEEP 98304:lhpBinjOykGcIy6fnUm8UdjoKjog/PvOAjcXvvOOc5DjoGjoG:TpAnjOyny6f18UZoso2HOAoXvvOPoQoG
- TLSH T10DB67C1EB36842B6D0B3C0B9C9969746E6717C51473196CF2284B76D2F777E28E3A320
- MD5 SHA1 SHA512 SSDEEP TLSH