Analysis
- max time kernel
149s - max time network
93s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
03/05/2026, 11:17
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win11-20260130-en
windows11-21h2-x64
5 signatures
150 seconds
General
- Target 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
- Size 12.1MB
- Sample260503-nd6dsafz7t
- SHA256 ccf3f55c87d7200e409feea5f0988ce2ba199ab93facc059dbe2e58bae81e1ce
- MD5 43f6a510a2734bc79c4a01c594161eb2
- SHA1 a0807ec7c414768cdb431f5f49948bfef26288bd
- SHA512 ef87d3a89bcf069ec7ea84975ac15dbf3497bb8515cc00126f455dbbb1f1af919a353d785393f8061b9717307b231d81af9dcd4d2455d9acbc1525b44fc4bcaa
- SSDEEP 196608:8pAnjOyAdOrfHWyZ/K0ttYVAATKocEU8IBtzYoS:OAniyZ/K0ttYZTdcEU8IBJXS
- TLSH T10DD69E13F2A401F9E0A6D178CA665322DB717C650BB1D3DF2254B6E92F33BD06A39721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule behavioral2/files/0x000e000000028e7a-4.dat UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\ByteCodeGenerator.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\setx.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\userinit.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Taskmgr.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\TpmTool.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\WerFault.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\appidtel.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cleanmgr.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\dvdplay.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\eudcedit.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ieUnatt.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wextract.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\winrshost.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\dccw.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\eventvwr.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\printui.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SyncHost.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\TpmInit.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wlanext.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\icsunattend.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SystemUWPLauncher.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\RMActivate_ssp_isv.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ARP.EXE 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\fc.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\findstr.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\gpupdate.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\logman.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\winrshost.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\bthudtask.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Com\comrepl.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cttunesvr.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\iscsicli.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ktmutil.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\label.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\secinit.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\net1.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\RMActivate_ssp_isv.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SndVol.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\tar.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\bthudtask.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\odbcconf.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\regedit.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\timeout.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cacls.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\dialer.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\fsutil.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\MRINFO.EXE 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\netbtugc.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\print.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\setupugc.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\xwizard.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\dllhost.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\mmgaserver.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ndadmin.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\rekeywiz.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wusa.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Windows Mail\wabmig.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\7-Zip\7z.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\7-Zip\7zG.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Windows Mail\wabmig.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateBroker.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Mail\wab.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateCore.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Media Player\wmplayer.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\7-Zip\7z.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\show_third_party_software_licenses.bat- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-d..s-vmswitch-netsetup_31bf3856ad364e35_10.0.22000.493_none_7f8453c6e0afd8f5\nvspinfo.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ter-cimprovider-exe_31bf3856ad364e35_10.0.22000.1_none_b98d3baff0bf243b\Register-CimProvider.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.1_none_0384636b13b61c9e\TiFileFetcher.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\x86_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_10.0.22000.1_none_aef18f12e09924ba\aspnet_regiis.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\csc.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.22000.318_none_2bc95a47eaa37094\f\hvix64.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-calc_31bf3856ad364e35_10.0.22000.1_none_00019ee11f850b6d\calc.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pickerhost_31bf3856ad364e35_10.0.22000.1_none_03f10908532480fe\PickerHost.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-nltest_31bf3856ad364e35_10.0.22000.434_none_95bd8d59818abcd7\f\nltest.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\msil_c2wtshost_31bf3856ad364e35_10.0.22000.1_none_14b6e41f87bda897\c2wtshost.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.22000.1_none_4548a15e322e11ac\chgport.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.22000.282_none_5faf7b34bce42c4c\f\SearchIndexer.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.22000.376_none_2d61a5193292e66c\f\audit.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-iexpress_31bf3856ad364e35_11.0.22000.1_none_eeb0f55fae54e327\wextract.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..pture-wmiv2provider_31bf3856ad364e35_10.0.22000.1_none_3ad96689f86d60ce\NetEvtFwdr.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-clientcore_31bf3856ad364e35_10.0.22000.282_none_a808d085c7f06d67\f\nfsclnt.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.22000.120_none_32bd480a87134e0f\sdchange.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.22000.1_none_3af3f70bfdcd4fb1\tskill.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_netfx4-applaunch_exe_b03f5f7f11d50a3a_4.0.15806.0_none_a8a04742bfab2375\AppLaunch.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..tional-chinese-core_31bf3856ad364e35_10.0.22000.1_none_ba1c45853a21e276\IMTCPROP.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-commandline-dsdiag_31bf3856ad364e35_10.0.22000.434_none_478d6c55833b17ab\f\dcdiag.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.22000.376_none_fbeabbf57111df0a\vfpctrl.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lockapp.appxmain_31bf3856ad364e35_10.0.22000.348_none_e2c7a9ab59285812\LockApp.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpkinstall_31bf3856ad364e35_10.0.22000.1_none_5f76a2d64fd541c0\lpkinstall.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_windowssearchengine_31bf3856ad364e35_7.0.22000.348_none_5f6e7d4cbd14f8f7\f\SearchProtocolHost.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\splwow64.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\OOBENetworkConnectionFlow.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SystemApps\Windows.CBSPreview_cw5n1h2txyewy\CameraBarcodeScannerPreview.exe 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_10.0.22000.65_none_64161fe87cb55cea\f\pcaui.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..kgroundtransferhost_31bf3856ad364e35_10.0.22000.1_none_e4c8388cb4892f1c\BackgroundTransferHost.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.318_none_82292a5c4e657627\ScreenClippingHost.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.22000.194_none_a9ffdf7b2efc21ec\r\wuauclt.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.22000.376_none_fbeabbf57111df0a\f\vfpctrl.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_11.0.22000.1_none_b997188789a17210\ieUnatt.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pcwdiagnostic_31bf3856ad364e35_10.0.22000.120_none_f090fec284d5941b\pcwrun.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mapi_31bf3856ad364e35_10.0.22000.120_none_b1071c7fd34df0e8\r\fixmapi.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-regsvr32_31bf3856ad364e35_10.0.22000.1_none_d8ef654968ad6d9d\regsvr32.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..ative-serverbox-isv_31bf3856ad364e35_10.0.22000.120_none_fad0aab9b7fd2208\r\RMActivate_ssp_isv.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\x86_netfx4-cvtres_exe_b03f5f7f11d50a3a_4.0.15806.0_none_995af40fe4edc5b6\cvtres.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mapi_31bf3856ad364e35_10.0.22000.120_none_a6b2722d9eed2eed\fixmapi.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-recoverydrive_31bf3856ad364e35_10.0.22000.132_none_23ef129810e14356\r\RecoveryDrive.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-lsatrustlet_31bf3856ad364e35_10.0.22000.258_none_dfe62f4e03f8472a\LsaIso.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-services-svchost_31bf3856ad364e35_10.0.22000.1_none_1653a1993e779350\svchost.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-web-app-host_31bf3856ad364e35_10.0.22000.1_none_93280ed008349bc8\WWAHost.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..okerplugin.appxmain_31bf3856ad364e35_10.0.22000.469_none_5704c6175ad01b79\f\Microsoft.AAD.BrokerPlugin.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.22000.469_none_e653782f0144d814\f\systemreset.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.22000.282_none_d037578ed2162e06\r\sdbinst.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bootux.deployment_31bf3856ad364e35_10.0.22000.1_none_9454ea72d50a2bf6\bootim.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..tional-chinese-core_31bf3856ad364e35_10.0.22000.1_none_afc79b3305c1207b\IMTCPROP.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iscsi_initiator_ui_31bf3856ad364e35_10.0.22000.1_none_2e2ec85760daf294\iscsicpl.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.22000.1_none_d3608b4d6c1da7eb\chcp.com- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_windows-defender-service_31bf3856ad364e35_10.0.22000.1_none_1be9c0745b95a762\MpCopyAccelerator.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-x..jectdialog.appxmain_31bf3856ad364e35_10.0.22000.120_none_f698302c22284569\f\XGpuEjectDialog.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ilasm.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-t..lipboardredirection_31bf3856ad364e35_10.0.22000.376_none_fd0b376d9072c88a\f\rdpclip.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-x..jectdialog.appxmain_31bf3856ad364e35_10.0.22000.120_none_f698302c22284569\XGpuEjectDialog.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_wcf-servicemodelreg_b03f5f7f11d50a3a_10.0.22000.1_none_0969e5301d4a0c1b\ServiceModelReg.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.22000.282_none_555ad0e288836a51\r\SearchFilterHost.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..me-japanese-setting_31bf3856ad364e35_10.0.22000.1_none_12c84018b608c95b\IMJPSET.EXE- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-explorer_31bf3856ad364e35_10.0.22000.120_none_576e8243334ab082\explorer.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.22000.1_none_7181babcedfc2cb7\iisreset.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SystemApps\Microsoft.AccountsControl_cw5n1h2txyewy\AccountsControlHost.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.22000.282_none_fbdbe8fb711d9878\vfpctrl.exe- 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-03_43f6a510a2734bc79c4a01c594161eb2_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4708
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 12.7MB
- SHA256 d43188f6e98fe755781f4ec6d97a6195765f64a29106aeef6696ef28dcd5cd25
- MD5 a625e4221c45282f7795ec673368032b
- SHA1 9400f3953acff70d64a125f044b6a6ab0fcb0673
- SHA512 5d158571c9426219e9f183f992a61e72ffdf525a2359a689431e36182af765d6303ebe28e81352aa6e0dc117cfaa2118c81cc67183441044bd4d7ca7e44a664a
- SSDEEP 196608:8pAnjOyAdOrfHWyZ/K0ttYVAATKocEU8IBtzYoYoG:OAniyZ/K0ttYZTdcEU8IBJXXG
- TLSH T1F8D69E13F2A402F9D077D178CA665322EB717C550BB1D6CF2244B6A92F33BD16A3A721
- MD5 SHA1 SHA512 SSDEEP TLSH