Analysis
- max time kernel
149s - max time network
153s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
23/04/2026, 18:57
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe
Resource
win11-20260130-en
windows11-21h2-x64
5 signatures
150 seconds
General
- Target 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe
- Size 3.8MB
- Sample260423-xmfddsfx4t
- SHA256 71da313f61dc5c5a7b213dee0ea5fc8d6b6835d50168c2ac7e1598b0cf8bb6d8
- MD5 86036062cd0f100e144f002854cf2eb9
- SHA1 c7e77c7f4aa4b3ebfbcbca834d96e53229be847f
- SHA512 aaba1a37736b48638e9daf795b6f6f0e8b662e3fe2c4b8e84af110b609ce8021748fe41666cd4b9899fd45b4f7e9817f694d1288b82378997fbcdcaa217bfad2
- SSDEEP 49152:kpPZuyWSG+BBvGvnjOyYVGlqRONszVBXdc/RJzVBXfqJtb2Ib+e:khpBinjOykGcPdOR5fq
- TLSH T1D5069C16B3804237E0B391B5C5AA5741DA7138B81B31D3DB7388B65A2E337D2993B772
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule behavioral2/files/0x001d00000002b1b8-4.dat UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\wbem\WMIC.exe 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\SysWOW64\cmdkey.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\SysWOW64\icacls.exe 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\SysWOW64\RMActivate_ssp_isv.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\SysWOW64\setupugc.exe 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\SysWOW64\wlanext.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\SysWOW64\xcopy.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\SysWOW64\eventvwr.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\SysWOW64\ktmutil.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\SysWOW64\ROUTE.EXE 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\SysWOW64\SyncHost.exe 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\SysWOW64\mmgaserver.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\SysWOW64\perfmon.exe 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\SysWOW64\wextract.exe 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\SysWOW64\wowreg32.exe 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\SysWOW64\certutil.exe 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\SysWOW64\ctfmon.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\SysWOW64\newdev.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\SysWOW64\winrshost.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\SysWOW64\compact.exe 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\SysWOW64\dllhost.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\SysWOW64\logagent.exe 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\SysWOW64\poqexec.exe 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\SysWOW64\srdelayed.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\SysWOW64\typeperf.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\SysWOW64\relog.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\SysWOW64\runas.exe 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\SysWOW64\netsh.exe 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\SysWOW64\quickassist.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\SysWOW64\dfrgui.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\SysWOW64\dtdump.exe 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\SysWOW64\findstr.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\SysWOW64\sfc.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\SysWOW64\help.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\SysWOW64\recover.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\SysWOW64\runonce.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\SysWOW64\xcopy.exe 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\SysWOW64\autochk.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\SysWOW64\dialer.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\SysWOW64\PkgMgr.exe 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\SysWOW64\upnpcont.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\SysWOW64\getmac.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\SysWOW64\isoburn.exe 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\SysWOW64\mshta.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\SysWOW64\Netplwiz.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\SysWOW64\wscript.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\SysWOW64\choice.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\SysWOW64\cmdl32.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\SysWOW64\dcomcnfg.exe 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.exe 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Program Files\Windows Media Player\wmprph.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Program Files (x86)\Windows Mail\wab.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Program Files\Mozilla Firefox\updater.exe 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateCore.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Program Files\Windows NT\Accessories\wordpad.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{E82B72DE-E604-4D8F-B1D7-38905DC82757}\MicrosoftEdge_X64_139.0.3405.125.exe 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\elevation_service.exe 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\IEExec.exe 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.22000.469_none_3038532b4b83a565\f\wowreg32.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-x..rtificateenrollment_31bf3856ad364e35_10.0.22000.1_none_49da5498936ff387\CertEnrollCtrl.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\WinSxS\x86_microsoft-windows-s..or-native-serverbox_31bf3856ad364e35_10.0.22000.120_none_0f0554e930e1de1c\r\RMActivate_ssp.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-apprep-chxapp.appxmain_31bf3856ad364e35_10.0.22000.120_none_334ea48b976d3bd3\CHXSmartScreen.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-srdelayed_31bf3856ad364e35_10.0.22000.1_none_b6f59fcb95517038\srdelayed.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\WinSxS\amd64_curl_31bf3856ad364e35_10.0.22000.434_none_79ca17dba25cd0c9\curl.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.22000.282_none_069016efd47610d8\f\wmpshare.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unattendedjoin_31bf3856ad364e35_10.0.22000.1_none_09588245719db19c\djoin.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-complus-setup_31bf3856ad364e35_10.0.22000.1_none_3feb76eef41741bf\mtstocom.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.22000.348_none_1cb0f82bf1aef3cc\r\lpremove.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ndation-frameserver_31bf3856ad364e35_10.0.22000.318_none_b139c7be49b8cbb9\r\FsIso.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..csengine-nativehost_31bf3856ad364e35_10.0.22000.1_none_70698255615a88a2\sdiagnhost.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..sionagent-uachelper_31bf3856ad364e35_10.0.22000.120_none_b61f094deaec819e\RdpSaUacHelper.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..sition-uicomponents_31bf3856ad364e35_10.0.22000.1_none_25381cfb8a14a984\wiaacmgr.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-international-unattend_31bf3856ad364e35_10.0.22000.1_none_20b20a4d26c387fd\MuiUnattend.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-setup360-media-base_31bf3856ad364e35_10.0.22000.469_none_259c259bf9e2d267\f\SetupPrep.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-s..ative-serverbox-isv_31bf3856ad364e35_10.0.22000.120_none_fad0aab9b7fd2208\f\RMActivate_ssp_isv.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\SystemApps\Microsoft.Windows.FileExplorer_cw5n1h2txyewy\FileExplorer.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.22000.469_none_160103e31c4d8d88\f\SystemSettings.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.22000.318_none_9b6af6ae8c0ac6cb\r\dtdump.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\WinSxS\amd64_windows-securityhealth-sso_31bf3856ad364e35_10.0.22000.100_none_bac6834bfb16b20d\f\SecurityHealthSystray.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-winhstb_31bf3856ad364e35_10.0.22000.1_none_899e56514290a73c\winhlp32.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lsa-minwin_31bf3856ad364e35_10.0.22000.282_none_3891f56e17aabe62\f\lsass.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sethc_31bf3856ad364e35_10.0.22000.1_none_b903dc9f79e461c1\EaseOfAccessDialog.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-aarsvc_31bf3856ad364e35_10.0.22000.1_none_c387f681de81f59d\agentactivationruntimestarter.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-scripting_31bf3856ad364e35_10.0.22000.194_none_4385d5a885bc9a36\f\wscript.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-shell-shellappruntime_31bf3856ad364e35_10.0.22000.469_none_0defc0f5807dd5f0\f\ShellAppRuntime.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-i..switch-toasthandler_31bf3856ad364e35_10.0.22000.37_none_b6eb9704869b2bfc\f\InputSwitchToastHandler.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-console-host-core_31bf3856ad364e35_10.0.22000.120_none_68fb744ea962915c\conhost.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-at_31bf3856ad364e35_10.0.22000.1_none_a345420f88ad9925\at.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..-network-management_31bf3856ad364e35_10.0.22000.1_none_1aa5e4c18d034965\nmbind.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..switch-toasthandler_31bf3856ad364e35_10.0.22000.37_none_b6eb9704869b2bfc\f\InputSwitchToastHandler.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\jsc.exe 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\x86_microsoft-windows-packagemanager_31bf3856ad364e35_10.0.22000.120_none_8c1e5976c0145439\f\PkgMgr.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\WinSxS\amd64_windows.networking.vpn.nethost_31bf3856ad364e35_10.0.22000.1_none_23bf602c090692bb\NetHost.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..acyinkingcomponents_31bf3856ad364e35_10.0.22000.1_none_a28a13c3c2bf1e9c\pipanel.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.22000.348_none_1cb0f82bf1aef3cc\f\lpksetup.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.22000.318_none_2bc95a47eaa37094\hvix64.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..-network-management_31bf3856ad364e35_10.0.22000.1_none_1aa5e4c18d034965\nmscrub.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-recoverydrive_31bf3856ad364e35_10.0.22000.132_none_23ef129810e14356\f\RecoveryDrive.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\LockApp.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-commandline-dsdiag_31bf3856ad364e35_10.0.22000.434_none_478d6c55833b17ab\f\dcdiag.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-shellappruntime_31bf3856ad364e35_10.0.22000.469_none_0defc0f5807dd5f0\ShellAppRuntime.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..ing-management-host_31bf3856ad364e35_10.0.22000.1_none_2790769f75be6dd7\DismHost.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-castserver_31bf3856ad364e35_10.0.22000.1_none_1de2c1a435cdd4e6\CastSrv.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-control_31bf3856ad364e35_10.0.22000.318_none_94e400242f9bfd4a\r\control.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.22000.348_none_75b35e16f6608fe4\WerFault.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.22000.1_none_c1bbc2c937fef3c3\diskperf.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wusa_31bf3856ad364e35_10.0.22000.1_none_0d98d97551c6b097\wusa.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\WinSxS\wow64_windows-defender-service_31bf3856ad364e35_10.0.22000.1_none_263e6ac68ff6695d\MpCmdRun.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Ldr64.exe 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..onment-core-tcbboot_31bf3856ad364e35_10.0.22000.318_none_fbf48b4fce07c440\f\tcblaunch.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-ksetup_31bf3856ad364e35_10.0.22000.434_none_17cb2e5ad35a58c9\r\ksetup.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-twinui_31bf3856ad364e35_10.0.22000.318_none_6f1f7e973e7f527f\LaunchWinApp.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.318_none_82292a5c4e657627\n\MiniSearchHost.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.22000.282_none_555ad0e288836a51\r\SearchProtocolHost.exe- 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-23_86036062cd0f100e144f002854cf2eb9_amadey_cobalt-strike_coinminer_elex_glassworm_icedid_njr.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1532
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 4.3MB
- SHA256 b14c98ebf4ff616361336384233c696cf50bee9051c1b1fea3350efedd4c97f7
- MD5 f7536c82e87cd6ddaa7f631abe11b9ec
- SHA1 ccd9ba4035bc29c1a32efe16411a22b4c5a05a21
- SHA512 f7420f5f63210e86d73e60c7e1c2865005ecb6d5b2fcc53c0b548641a2074962b813fe433f4042406780d8146d78a83ed827264657824da90f94864bc15d1011
- SSDEEP 49152:kpPZuyWSG+BBvGvnjOyYVGlqRONszVBXdc/RJzVBXfqJtb2Ib+UPji0Aji:khpBinjOykGcPdOR5fWjom
- TLSH T1EE268B16B2904337E0B390B5C5AA5745DA7138B91B31C3DB7388B65A2E337D2893B772
- MD5 SHA1 SHA512 SSDEEP TLSH