Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
03/05/2026, 04:26
Behavioral task
behavioral1
Sample
2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
- Size 8.3MB
- Sample260503-e2ljvabw3t
- SHA256 22c5a7f23e60ad54d1e08470ddd64c8733245d2789a0d231439f807b5eee3bf9
- MD5 e3ef0bf78df976c07f6de00a68731c98
- SHA1 cd2a2c83040392e3efdc50f905a398b7d434e8c6
- SHA512 63728995ed4422fcc861c4473f026e12e775ac6ba59ae540864dd978997d1c5de23ad27dd77ffd6632800287ad51ab496ee91333f3911b8d97b8de9dbcc996c6
- SSDEEP 98304:ShpBinjOykGcIBdAWQtZ/K0tGOFWVRuQHD5fkZcDB:WpAnjOynBdAWyZ/K0ttYVAQHhPDB
- TLSH T19B968D16F2A44376D0B3C0B9C6D6A756EA3234951B30D6CB2385F7692E33BD1863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule behavioral1/files/0x000c000000024128-5.dat UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\iexpress.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\shrpubw.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Robocopy.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\chkntfs.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\curl.exe 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\dpnsvr.exe 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\lodctr.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Taskmgr.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\fc.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\reg.exe 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SyncHost.exe 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\dplaysvr.exe 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\grpconv.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\PING.EXE- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\control.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\fc.exe 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\format.com 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\mavinject.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\mode.com 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ROUTE.EXE 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\setup16.exe 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\tzutil.exe 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\regsvr32.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\TCPSVCS.EXE- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wextract.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\clip.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cmd.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cscript.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\mmgaserver.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\systray.exe 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\tar.exe 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\WWAHost.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\OpenWith.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SecEdit.exe 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ktmutil.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ROUTE.EXE- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\dccw.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\fontview.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\perfhost.exe 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\where.exe 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\autoconv.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\iscsicli.exe 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\upnpcont.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\dplaysvr.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\help.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\icacls.exe 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ieUnatt.exe 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\tree.com 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe -
resource yara_rule behavioral1/memory/5020-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/files/0x000c000000024128-5.dat upx behavioral1/memory/5020-780-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/5020-3196-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Windows Mail\wab.exe 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Windows Media Player\wmprph.exe 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Internet Explorer\ExtExport.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-iechooser_31bf3856ad364e35_11.0.19041.1_none_da5b9e6604736fbe\IEChooser.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.19041.1_none_15114cf4ffe3136a\cmmon32.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.19041.1_none_e8b8012dee3ba92e\ROUTE.EXE- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.19041.1110_none_b678ec2deb73b201\r\msra.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_a4f6113bccc284b7\tscon.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_state.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..kgroundtransferhost_31bf3856ad364e35_10.0.19041.746_none_6c7de5b30e8f6071\r\BackgroundTransferHost.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..onagent-proxyobject_31bf3856ad364e35_10.0.19041.1_none_19667e7e60cb0ccd\RdpSaProxy.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-terminalservices-theme_31bf3856ad364e35_10.0.19041.1_none_962bc7b24e8d9f3a\TSTheme.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-magnify_31bf3856ad364e35_10.0.19041.84_none_65d0f4a4c6cd4975\r\Magnify.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\MicrosoftEdge.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-cttune_31bf3856ad364e35_10.0.19041.1_none_73ca4447924360c1\cttune.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-restartmanager_31bf3856ad364e35_10.0.19041.1_none_407b1fa0f7dce496\RmClient.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-robocopy_31bf3856ad364e35_10.0.19041.1_none_874ce756c022852f\Robocopy.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..usnotificationuxexe_31bf3856ad364e35_10.0.19041.153_none_51feabe070ab84f6\f\MusNotificationUx.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SystemApps\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\PinningConfirmationDialog.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-narrator_31bf3856ad364e35_10.0.19041.84_none_b5c0f628d1d661eb\r\Narrator.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..eldebugger-recorder_31bf3856ad364e35_10.0.19041.1_none_1a55178fad503598\tttracer.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_49716c2392052aca\f\logman.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_a4f6113bccc284b7\tskill.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1288_none_71734bf99a2a6955\Microsoft.Uev.SyncController.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_10.0.19041.1_none_b970f5eb6342eadb\dpnsvr.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-bash_31bf3856ad364e35_10.0.19041.1151_none_b46b739f71bbb8b7\bash.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ices-appcompattools_31bf3856ad364e35_10.0.19041.1_none_a9109d150b1bf064\acregl.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\OOBENetworkConnectionFlow.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..deploymentmgrclient_31bf3856ad364e35_10.0.19041.1202_none_c26e06f4b82585b5\f\dmclient.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..oler-filterpipeline_31bf3856ad364e35_10.0.19041.264_none_098f3a6c3a48359d\f\printfilterpipelinesvc.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rundll32_31bf3856ad364e35_10.0.19041.746_none_b5fe9c5c09b9d7a9\rundll32.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-c..mplus-admin-comrepl_31bf3856ad364e35_10.0.19041.1_none_aa4f3617632d6024\comrepl.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..raries-servercommon_31bf3856ad364e35_10.0.19041.264_none_91c1d6c40350b1b6\appcmd.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-thumbexthost_31bf3856ad364e35_10.0.19041.746_none_d8baedf8d09aba05\f\ThumbnailExtractionHost.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\jsc.exe 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-gaming-ga..rnal-presencewriter_31bf3856ad364e35_10.0.19041.1_none_b817dbd29134ec4d\GameBarPresenceWriter.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.19041.1_none_330dfb2b06b21af6\replace.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vssadmin_31bf3856ad364e35_10.0.19041.1_none_7a6e62f3d1012ed4\vssadmin.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iscsi_initiator_ui_31bf3856ad364e35_10.0.19041.1_none_9830e2872fd0279a\iscsicpl.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-netbt_31bf3856ad364e35_10.0.19041.746_none_48b2bd808a742e25\r\netbtugc.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..sition-uicomponents_31bf3856ad364e35_10.0.19041.1_none_8f3a372b5909de8a\wiaacmgr.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-filtermanager-utils_31bf3856ad364e35_10.0.19041.546_none_01dba454b887ba53\r\fltMC.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-defrag-cmdline_31bf3856ad364e35_10.0.19041.746_none_a5751a882524bee1\f\Defrag.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-unlock_31bf3856ad364e35_10.0.19041.746_none_428efbd28b482d1c\bdeunlock.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.19041.84_none_29cf9b86db5fb249\audit.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasclienttools_31bf3856ad364e35_10.0.19041.1_none_2f8c879e7c6f8b16\rasdial.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.19041.746_none_c7c6fccae233c8b7\r\uwfux.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..randprintui-ntprint_31bf3856ad364e35_10.0.19041.1288_none_64cb20c6329bf2bd\ntprint.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-musnotifyiconexe_31bf3856ad364e35_10.0.19041.153_none_1721bd4ad34c0544\f\MusNotifyIcon.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SystemApps\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\XGpuEjectDialog.exe 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..omerfeedbackmanager_31bf3856ad364e35_10.0.19041.1_none_9224c91b2d8eed57\imecfmui.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.19041.906_none_198d8d483aa30ed0\f\gpupdate.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..alcontrols.appxmain_31bf3856ad364e35_10.0.19041.1266_none_1833f07ce0c90b68\f\WpcUapApp.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-autofmt_31bf3856ad364e35_10.0.19041.1_none_a639f4b392ec604e\autofmt.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.19041.1110_none_20a89186aedb6af7\f\msinfo32.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..nsimulation-service_31bf3856ad364e35_10.0.19041.746_none_b6b8620636970859\r\PerceptionSimulationService.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.19041.1202_none_dfaaff89afe4f3d4\f\vds.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasclienttools_31bf3856ad364e35_10.0.19041.1_none_2f8c879e7c6f8b16\rasphone.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.19041.1202_none_27f9f931a79d1cbe\f\mavinject.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..riseclientsync-host_31bf3856ad364e35_10.0.19041.207_none_ac38fc33d542b487\WorkFolders.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-office-csp_31bf3856ad364e35_10.0.19041.844_none_9b62a70f9278f2cd\ofdeploy.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pcwdiagnostic_31bf3856ad364e35_10.0.19041.1266_none_69f1a169b4d96a7c\r\pcwrun.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.207_none_e2f2dfeea7fa44fc\icsunattend.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe- 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-03_e3ef0bf78df976c07f6de00a68731c98_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5020
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 8.9MB
- SHA256 b3eec5c74189b732135f3d24e51ba3b741a08115302552b89106dc4704b07bc1
- MD5 7d96c154f166412375494885baa7f783
- SHA1 2c54a33f310ed0a77a7c85a27b1be1decd2b9ef6
- SHA512 092da39f3764a5e9cafd6f70d8f18a8a6e408355f92fe57fe2000100b6694f35134daa8256a3b75ffa1387c4f914cca1fd12e383f29ad9342953f2710c616a67
- SSDEEP 98304:ShpBinjOykGcIBdAWQtZ/K0tGOFWVRuQHD5fkZcD1joR:WpAnjOynBdAWyZ/K0ttYVAQHhPDBoR
- TLSH T1F3968D16F2A44376D0B3C0B9C6D6A756EA3234951B30D6CB1385F7692E33BE1863A731
- MD5 SHA1 SHA512 SSDEEP TLSH