Analysis
- max time kernel
149s - max time network
126s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
03/05/2026, 03:30
Behavioral task
behavioral1
Sample
2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
- Size 8.2MB
- Sample260503-d2hbraex2j
- SHA256 97abfee4229ce8d273ec1dd7143e1a2517c1f99dcb4bec8d2c94397049aace5c
- MD5 4f4644743863113322d53a1ea8f3ebf5
- SHA1 4ee3195180cde6e88a0fb2f53598b40c2988b346
- SHA512 34345bb78027174112820487526307bf29f51cdbd9e26314b37d491168a491abcf6c3b7c4a3fc382da659f23212e351204b1db4b07132bb53d19453844355a88
- SSDEEP 98304:ShpBinjOykGcIBdAWQtZ/K0tGOFWVRuQHD5fkZcEdt:WpAnjOynBdAWyZ/K0ttYVAQHhPEdt
- TLSH T1D0869D16F2A44376D0B3D079C6D6A756EA3234551B30D6CF2384B7692E33BE18A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule behavioral1/files/0x0008000000024339-5.dat UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\charmap.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ddodiag.exe 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\dpnsvr.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\expand.exe 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\gpscript.exe 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\tar.exe 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cmmon32.exe 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\finger.exe 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\mfpmp.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\MRINFO.EXE 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\tzutil.exe 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\w32tm.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\bthudtask.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\chkdsk.exe 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cttunesvr.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\edpnotify.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ipconfig.exe 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Robocopy.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\TCPSVCS.EXE- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\WWAHost.exe 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\fltMC.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ntprint.exe 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\sfc.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\srdelayed.exe 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\tasklist.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\winrm.cmd- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\dpapimig.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\iscsicpl.exe 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\auditpol.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\control.exe 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\printui.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\tcmsetup.exe 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\appidtel.exe 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\icacls.exe 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\mountvol.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\certutil.exe 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\compact.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\mstsc.exe 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\netsh.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\powercfg.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\scrnsave.scr 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\setup16.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\eventvwr.exe 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\MuiUnattend.exe 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\rasdial.exe 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\sxstrace.exe 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\fontview.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\gpupdate.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ipconfig.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\logagent.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\openfiles.exe 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\poqexec.exe 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SystemUWPLauncher.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cipher.exe 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe -
resource yara_rule behavioral1/memory/1724-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/files/0x0008000000024339-5.dat upx behavioral1/memory/1724-776-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/1724-3204-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Media Player\setup_wm.exe 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Internet Explorer\ieinstal.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Mozilla Firefox\nmhproxy.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\show_third_party_software_licenses.bat 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-assignedaccess-guard_31bf3856ad364e35_10.0.19041.844_none_10a0a60f1ec9cc10\n\AssignedAccessGuard.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unp_31bf3856ad364e35_10.0.19041.1266_none_21c0be7c0dad3632\r\UNPUXLauncher.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_wpf-presentationhostexe_31bf3856ad364e35_10.0.19041.1_none_25e540d4bf7b64b4\PresentationHost.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wmi-core-providerhost_31bf3856ad364e35_10.0.19041.546_none_f8b0afde1e951639\f\WmiPrvSE.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..tegrity-diagnostics_31bf3856ad364e35_10.0.19041.1_none_224ac1aa56b7c6c2\CIDiag.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-diskpart_31bf3856ad364e35_10.0.19041.964_none_510ebdd9292eed06\diskpart.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..deploymentmgrclient_31bf3856ad364e35_10.0.19041.1_none_039ee78ea24cb495\dmclient.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-netbt_31bf3856ad364e35_10.0.19041.572_none_3e399e76562f6053\f\netbtugc.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.19041.746_none_7c508e4438cec899\f\LicensingUI.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lipboardredirection_31bf3856ad364e35_10.0.19041.746_none_dfcf5b6f69f16f7a\rdpclip.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_10.0.19041.746_none_56f2f7338735a9a6\r\WFS.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.19041.906_none_198d8d483aa30ed0\r\gpupdate.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-musnotifyiconexe_31bf3856ad364e35_10.0.19041.153_none_1721bd4ad34c0544\r\MusNotifyIcon.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.19041.746_none_4d67350a685e1a3a\bthudtask.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-atbroker_31bf3856ad364e35_10.0.19041.1023_none_4478665ed379a3fc\AtBroker.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-recdisc-main_31bf3856ad364e35_10.0.19041.84_none_7c1f17a9e1beaf63\f\recdisc.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-smartscreen_31bf3856ad364e35_10.0.19041.1052_none_323c9a9ad543e3a3\f\smartscreen.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-gpowershell-exe_31bf3856ad364e35_10.0.19041.1_none_f8d6d7787573666b\powershell_ise.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..omerfeedbackmanager_31bf3856ad364e35_10.0.19041.1_none_9224c91b2d8eed57\imecfmui.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskapilibrary_31bf3856ad364e35_10.0.19041.1266_none_622873cfbda33994\f\convertvhd.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-provisioning-core_31bf3856ad364e35_10.0.19041.844_none_95c651508e565d13\r\provtool.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-safedocs-main_31bf3856ad364e35_10.0.19041.264_none_02eb5d2ec5a9ec02\r\sdclt.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-twinui_31bf3856ad364e35_10.0.19041.1202_none_e867a49a6e97813d\LaunchWinApp.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-atbroker_31bf3856ad364e35_10.0.19041.1023_none_4ecd10b107da65f7\r\AtBroker.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-explorer_31bf3856ad364e35_10.0.19041.1266_none_c67a7a982eedc4e8\f\explorer.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-safedocs-main_31bf3856ad364e35_10.0.19041.746_none_03030718c597d891\r\sdclt.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-speechcommonnoia64_31bf3856ad364e35_10.0.19041.1_none_b89a948362edb3e7\sapisvr.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-uso-dtuhandler_31bf3856ad364e35_10.0.19041.153_none_c0c4ee134c2535a0\r\DTUHandler.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.19041.1266_none_8a8440f738abd1b9\wmpconfig.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-notepad_31bf3856ad364e35_10.0.19041.1_none_2f60455143be03e9\notepad.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-autofmt_31bf3856ad364e35_10.0.19041.1266_none_5aba1063745f6e01\f\autofmt.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-ngc-trustlet_31bf3856ad364e35_10.0.19041.84_none_dd81fb99bc3b1e53\NgcIso.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.19041.1266_none_8a8440f738abd1b9\f\wmplayer.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_a4f6113bccc284b7\tsdiscon.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\AddInUtil.exe 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-extcom_31bf3856ad364e35_10.0.19041.1202_none_7f995fddf54c000c\SppExtComObj.Exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sethc_31bf3856ad364e35_10.0.19041.746_none_4b0e3418084b5511\r\sethc.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.19041.264_none_911b6d2a51481d59\mavinject.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-mbr2gpt_31bf3856ad364e35_10.0.19041.1237_none_6b74aa3973213895\f\MBR2GPT.EXE- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\x86_wpf-terminalserverwpfwrapperexe_31bf3856ad364e35_10.0.19041.1_none_7e31b18ab29f9913\TsWpfWrp.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\AddInUtil.exe 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..tegrity-diagnostics_31bf3856ad364e35_10.0.19041.985_none_4a26c2c5164ad5c7\f\CIDiag.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-omadmclient_31bf3856ad364e35_10.0.19041.1151_none_c86feb6936a97173\f\omadmclient.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-unifiedwritefilter_31bf3856ad364e35_10.0.19041.1266_none_110072d23cfc00d3\UwfServicingSvc.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.19041.928_none_bd769d14dfd7d29d\r\sdbinst.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_10.0.19041.1_none_6e398157aa492263\setup_wm.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-at_31bf3856ad364e35_10.0.19041.1_none_02f2b1ed23420c30\at.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..daryauthfactor-task_31bf3856ad364e35_10.0.19041.746_none_a9ff72b1a43fd663\DeviceCredentialDeployment.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-trustedinstaller_31bf3856ad364e35_10.0.19041.153_none_6ef8a222ac00dbc2\TrustedInstaller.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\HelpPane.exe 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_3f1cc1d15da468cf\typeperf.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-u..etry-client-wowonly_31bf3856ad364e35_10.0.19041.662_none_746c3bfaa509091f\r\dtdump.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dataexchangehost_31bf3856ad364e35_10.0.19041.746_none_c77d8290c75caeee\DataExchangeHost.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskapilibrary_31bf3856ad364e35_10.0.19041.1266_none_622873cfbda33994\r\convertvhd.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.19041.964_none_dddeea757b7fbba7\f\sftp.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.1_none_c6da8048542fddc7\aspnetca.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.19041.1_none_fbaeb6d5afb287f7\gpupdate.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-csrss_31bf3856ad364e35_10.0.19041.1_none_0ed4f15b837334c7\csrss.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-newdev_31bf3856ad364e35_10.0.19041.1202_none_8636783e05df6f4e\r\ndadmin.exe- 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-03_4f4644743863113322d53a1ea8f3ebf5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1724
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 8.7MB
- SHA256 643915e495b09f8f6999e6e746af7de6a506fdc94d5d5130213eefe8b2cd018d
- MD5 5f0424a24e62727edeadefb58cee702f
- SHA1 c576aca292c7bcc7f311a7a64b58c2e754716e1b
- SHA512 527fa431976001b84b257f334cac2edb373cc605c50b2cab34b6d12efb67ffe4264001751825e35c10d7e3b359bd3128d2cf6fb6afb45502a946c709c5b73939
- SSDEEP 98304:ShpBinjOykGcIBdAWQtZ/K0tGOFWVRuQHD5fkZcEdJjoX:WpAnjOynBdAWyZ/K0ttYVAQHhPEd9oX
- TLSH T1B4968D16F2A44376D0B3D079C6D6A756EA3234551B30D6CF2384B7692E33BE18A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH