Analysis
- max time kernel
149s - max time network
94s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
03/05/2026, 11:17
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win11-20260130-en
windows11-21h2-x64
5 signatures
150 seconds
General
- Target 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
- Size 12.1MB
- Sample260503-nd6dsafz7t
- SHA256 ccf3f55c87d7200e409feea5f0988ce2ba199ab93facc059dbe2e58bae81e1ce
- MD5 43f6a510a2734bc79c4a01c594161eb2
- SHA1 a0807ec7c414768cdb431f5f49948bfef26288bd
- SHA512 ef87d3a89bcf069ec7ea84975ac15dbf3497bb8515cc00126f455dbbb1f1af919a353d785393f8061b9717307b231d81af9dcd4d2455d9acbc1525b44fc4bcaa
- SSDEEP 196608:8pAnjOyAdOrfHWyZ/K0ttYVAATKocEU8IBtzYoS:OAniyZ/K0ttYZTdcEU8IBJXS
- TLSH T10DD69E13F2A401F9E0A6D178CA665322DB717C650BB1D3DF2254B6E92F33BD06A39721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule behavioral1/files/0x00100000000241fe-4.dat UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\SystemUWPLauncher.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\tcmsetup.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\iscsicli.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\newdev.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\secinit.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\systray.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\control.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\control.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\find.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\mstsc.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\OpenWith.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\poqexec.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\quickassist.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\forfiles.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\mfpmp.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\netbtugc.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\RdpSa.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\relog.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\RmClient.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\NETSTAT.EXE- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\relog.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\secinit.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\sort.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\systeminfo.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ttdinject.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\tzutil.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\MRINFO.EXE 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ntprint.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\powercfg.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\TpmTool.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\GamePanel.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\msiexec.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\sethc.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\winrshost.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\dcomcnfg.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\regini.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\RMActivate_ssp_isv.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\setupugc.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\taskkill.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wecutil.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\curl.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\rekeywiz.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\certreq.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ddodiag.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ktmutil.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\nslookup.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cmdkey.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\fltMC.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\rasphone.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\regedt32.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ROUTE.EXE- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\takeown.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\driverquery.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\uninstall.cmd- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Media Player\wmpshare.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Internet Explorer\ieinstal.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Internet Explorer\iexplore.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\144.0.3719.93\Installer\copilot_setup.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Windows Media Player\wmlaunch.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\elevation_service.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\7-Zip\7zG.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_3f1cc1d15da468cf\f\diskperf.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-eudcedit_31bf3856ad364e35_10.0.19041.1_none_19de3c7b933c6faf\eudcedit.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..onwakesettingflyout_31bf3856ad364e35_10.0.19041.746_none_8a469514405342ff\PasswordOnWakeSettingFlyout.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-registry-editor_31bf3856ad364e35_10.0.19041.746_none_dc7caa836f08ad57\regedt32.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..tegrity-diagnostics_31bf3856ad364e35_10.0.19041.1_none_224ac1aa56b7c6c2\CIDiag.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..tx-dxgiadaptercache_31bf3856ad364e35_10.0.19041.84_none_9f3e49455f52d8f7\f\dxgiadaptercache.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-telnet-client_31bf3856ad364e35_10.0.19041.1_none_6e229ee8c467f101\telnet.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.84_none_a689f818199cbaf8\Taskmgr.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fax-service_31bf3856ad364e35_10.0.19041.804_none_8b46258bdefa0beb\r\FXSSVC.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-srdelayed_31bf3856ad364e35_10.0.19041.1_none_0c4e6556fb852148\srdelayed.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..tnet-mua-hostserver_31bf3856ad364e35_10.0.19041.746_none_aee92417063babbe\WinRTNetMUAHostServer.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip_31bf3856ad364e35_10.0.19041.1_none_21cb4db26317f32e\netiougc.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ie-feedsbs_31bf3856ad364e35_11.0.19041.1_none_8a11dbe22c9bf6e1\msfeedssync.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-containerdiagnosticstool_31bf3856ad364e35_10.0.19041.928_none_6571ff6e96271a64\r\hcsdiag.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-isoburn_31bf3856ad364e35_10.0.19041.746_none_c42bf1ebf80a8661\isoburn.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wslconfig_31bf3856ad364e35_10.0.19041.1151_none_15ecde7059d11b7f\wslconfig.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..esslockapp.appxmain_31bf3856ad364e35_10.0.19041.844_none_15e5bfcd83a1911a\f\AssignedAccessLockApp.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sethc_31bf3856ad364e35_10.0.19041.746_none_40b989c5d3ea9316\r\EaseOfAccessDialog.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-taskhost_31bf3856ad364e35_10.0.19041.1_none_de2fb5dcf9b35f74\taskhostw.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.19041.1266_none_14b8c34dbc1df417\f\runexehelper.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_netfx35linq-addinprocess_31bf3856ad364e35_10.0.19041.1_none_e688384bec188769\AddInProcess.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..rvices-sessionagent_31bf3856ad364e35_10.0.19041.1_none_3b97be772075a03a\RdpSa.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SystemApps\microsoft.creddialoghost_cw5n1h2txyewy\CredDialogHost.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..ysafety-refreshtask_31bf3856ad364e35_10.0.19041.1266_none_d375b5361b806b32\f\WpcTok.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..kgroundtransferhost_31bf3856ad364e35_10.0.19041.746_none_6c7de5b30e8f6071\f\BackgroundTransferHost.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.19041.746_none_4d67350a685e1a3a\bthudtask.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sstext3d_31bf3856ad364e35_10.0.19041.1_none_ba29c601fef9ba5d\ssText3d.scr- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\csc.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-capturepicker.appxmain_31bf3856ad364e35_10.0.19041.423_none_12ca604b48f8d3fb\r\CapturePicker.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-convert_31bf3856ad364e35_10.0.19041.1266_none_119b1e415d838a28\r\autoconv.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-webcamexperience_31bf3856ad364e35_10.0.19041.746_none_4ae21b160a9d5bb2\r\CameraSettingsUIHost.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..environment-windows_31bf3856ad364e35_10.0.19041.1202_none_ddf8c4144200f5b4\winresume.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-mdmdiagnosticstool_31bf3856ad364e35_10.0.19041.1023_none_d3d892f3280079d7\f\MdmDiagnosticsTool.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ortingcompatibility_31bf3856ad364e35_10.0.19041.1081_none_737d8b2eaaa38234\DWWIN.EXE- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.19041.1_none_330dfb2b06b21af6\find.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-synchost_31bf3856ad364e35_10.0.19041.746_none_477a57e55b61aba8\r\SyncHost.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-managementconsole_31bf3856ad364e35_10.0.19041.1_none_3dc4aae45a75023d\InetMgr.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.19041.1266_none_5fd6523a3130632d\ResetEngine.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.19041.153_none_c8fbed52dad932cb\ResetEngine.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unattendedjoin_31bf3856ad364e35_10.0.19041.572_none_90e9bab3cbbfd71a\r\djoin.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-dtc-runtime_31bf3856ad364e35_10.0.19041.1_none_cf441068ff6081fd\msdtc.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.19041.153_none_70cb6ca43c818606\cmimageworker.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-dsdbutil_31bf3856ad364e35_10.0.19041.1_none_f58a3da76ed0f251\dsdbutil.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-embedded-shelllauncher_31bf3856ad364e35_10.0.19041.1202_none_b918e36ffc7a6ffe\r\ShellLauncherConfig.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..tionsnonwinpeplugin_31bf3856ad364e35_10.0.19041.572_none_846686e46b73c8e3\PnPUnattend.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_windows-defender-offline-amcore_31bf3856ad364e35_10.0.19041.1202_none_b9662ef4fe1412ad\f\OfflineScannerShell.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.19041.1288_none_1cec63974464878f\SenseCE.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-legacyhwui_31bf3856ad364e35_10.0.19041.1_none_98652fe6e79e6fc9\hdwwiz.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-autoplay_31bf3856ad364e35_10.0.19041.1_none_d0ebbe21df584658\wmlaunch.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_regsvcs_b03f5f7f11d50a3a_10.0.19041.1_none_636ab5ebe47bac5e\RegSvcs.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..cecontroller-minwin_31bf3856ad364e35_10.0.19041.928_none_1d29b4735b607954\r\services.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_9aa166e99861c2bc\chglogon.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tapisetup_31bf3856ad364e35_10.0.19041.1_none_1fe438473a878c5c\TapiUnattend.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unp_31bf3856ad364e35_10.0.19041.1266_none_21c0be7c0dad3632\UNPUXLauncher.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iis-legacysnapin_31bf3856ad364e35_10.0.19041.906_none_699a0ca245158f14\InetMgr6.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediafoundation_31bf3856ad364e35_10.0.19041.84_none_9e56f6c66f3fd630\mfpmp.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_10.0.19041.1_none_a3224c6911783037\IMJPDCT.EXE- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-net1-command-line-tool_31bf3856ad364e35_10.0.19041.844_none_64d33f8fb364398c\net1.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.19041.964_none_9a882af90ea09cc3\f\ssh-agent.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-regini_31bf3856ad364e35_10.0.19041.1_none_cc9bf4448d8f2bf4\regini.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.19041.1_none_f30cab80229c6b29\ROUTE.EXE- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..andlinepropertytool_31bf3856ad364e35_10.0.19041.844_none_e9349b06dfab6fdc\r\imjpuexc.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..mpropertiesadvanced_31bf3856ad364e35_10.0.19041.1_none_ad39955b83a3f25f\SystemPropertiesAdvanced.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2720
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 12.7MB
- SHA256 d43188f6e98fe755781f4ec6d97a6195765f64a29106aeef6696ef28dcd5cd25
- MD5 a625e4221c45282f7795ec673368032b
- SHA1 9400f3953acff70d64a125f044b6a6ab0fcb0673
- SHA512 5d158571c9426219e9f183f992a61e72ffdf525a2359a689431e36182af765d6303ebe28e81352aa6e0dc117cfaa2118c81cc67183441044bd4d7ca7e44a664a
- SSDEEP 196608:8pAnjOyAdOrfHWyZ/K0ttYVAATKocEU8IBtzYoYoG:OAniyZ/K0ttYZTdcEU8IBJXXG
- TLSH T1F8D69E13F2A402F9D077D178CA665322EB717C550BB1D6CF2244B6A92F33BD16A3A721
- MD5 SHA1 SHA512 SSDEEP TLSH