Analysis
- max time kernel
149s - max time network
137s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
11/05/2026, 12:08
Behavioral task
behavioral1
Sample
2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
- Size 8.9MB
- Sample260511-pbbxtsct5l
- SHA256 23159ceabf32b2959f4deaf8b10adab2c133bbeefc49e3bb5512cff3d87c2c22
- MD5 8e2948a9ee2df05195f39f1f78e5229e
- SHA1 8523830e0d62af4b4ef8f9f0ed86c1df6b26baed
- SHA512 b6fe1aa8e00c67741d7ae0811c2ad80bad3be3f11f929956018a588a75652970845c0ab6522b17c55499ebfdf96718f6f1cd776daddcdfbcf05346695ff13e37
- SSDEEP 98304:lhpBinjOykGcIBdAWQtZ/K0tGOFWVRuQgLapI1D8jo6:TpAnjOynBdAWyZ/K0ttYVAQgcI1io6
- TLSH T130967D12F2A00276D066D075CB969725EBB13C694BF0D2DB6244B3D92F33BD1B63A721
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule behavioral1/files/0x000a0000000241aa-5.dat UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\makecab.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\NETSTAT.EXE- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\dccw.exe 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\doskey.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\DWWIN.EXE 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\icsunattend.exe 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\regini.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\taskkill.exe 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\rasdial.exe 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\TRACERT.EXE- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\typeperf.exe 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\chkdsk.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\comp.exe 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\diskperf.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\efsui.exe 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\isoburn.exe 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\label.exe 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\rasautou.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\DpiScaling.exe 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\fc.exe 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\iscsicli.exe 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\iscsicpl.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SecEdit.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\WWAHost.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\convert.exe 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\mcbuilder.exe 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\msinfo32.exe 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\proquota.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\RMActivate_ssp_isv.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\scrnsave.scr 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\user.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wlanext.exe 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\GamePanel.exe 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ddodiag.exe 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\dtdump.exe 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\explorer.exe 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\find.exe 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\msiexec.exe 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\mspaint.exe 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\srdelayed.exe 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\compact.exe 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\dcomcnfg.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SndVol.exe 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\takeown.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wiaacmgr.exe 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Fondue.exe 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ntprint.exe 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\regsvr32.exe 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\fsutil.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\dllhost.exe 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\icsunattend.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\logagent.exe 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\NETSTAT.EXE 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe -
resource yara_rule behavioral1/memory/832-0-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/files/0x000a0000000241aa-5.dat upx behavioral1/memory/832-713-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/832-712-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/832-1417-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/832-2080-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/832-2851-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/832-3206-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/832-3207-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/832-3211-0x0000000000400000-0x000000000040F000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Windows Media Player\wmplayer.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\ink\mip.exe 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\dotnet\dotnet.exe 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Windows Media Player\setup_wm.exe 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\dotnet\dotnet.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Windows Media Player\wmprph.exe 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Mail\wab.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\wow64_microsoft-windows-mapi_31bf3856ad364e35_10.0.19041.423_none_93adcfb5ace23a89\fixmapi.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..esslockapp.appxmain_31bf3856ad364e35_10.0.19041.844_none_15e5bfcd83a1911a\AssignedAccessLockApp.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..andlinepropertytool_31bf3856ad364e35_10.0.19041.1_none_c12e5c6c2037e719\imjpuexc.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..restartup-repairbde_31bf3856ad364e35_10.0.19041.1_none_87e54edbaf62ca00\repair-bde.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..eldebugger-recorder_31bf3856ad364e35_10.0.19041.1_none_1a55178fad503598\ttdinject.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winre-recoverytools_31bf3856ad364e35_10.0.19041.1_none_8b3ee1f81086d0e3\ReAgentc.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft.windows.winhttp_31bf3856ad364e35_5.1.19041.264_none_7517ff6e147bc8a9\r\pacjsworker.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-taskkill_31bf3856ad364e35_10.0.19041.1_none_e5c3b6db2fced475\taskkill.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..ommandline-dsdbutil_31bf3856ad364e35_10.0.19041.844_none_c171e0be75e709de\f\dsdbutil.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.19041.264_none_5481650943811810\r\audiodg.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_10.0.19041.1_none_37ab35f7e4b21a45\PrintBrm.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.746_none_e2c6a972a81b8d2c\icsunattend.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-thumbexthost_31bf3856ad364e35_10.0.19041.1_none_b0b2b0b01128fbbb\ThumbnailExtractionHost.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SystemApps\Windows.CBSPreview_cw5n1h2txyewy\CameraBarcodeScannerPreview.exe 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-containers-ccg_31bf3856ad364e35_10.0.19041.844_none_3a7392af5414371e\f\CCG.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..oler-filterpipeline_31bf3856ad364e35_10.0.19041.264_none_098f3a6c3a48359d\f\printfilterpipelinesvc.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-refsutil_31bf3856ad364e35_10.0.19041.1_none_a0a8212dcec26473\refsutil.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-gaming-ga..rnal-presencewriter_31bf3856ad364e35_10.0.19041.1202_none_76e6fb38a70dbd6d\GameBarPresenceWriter.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-settingsynchost_31bf3856ad364e35_10.0.19041.1202_none_f4a35974d85ff180\SettingSyncHost.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_security-octagon-broker_31bf3856ad364e35_10.0.19041.84_none_51ae5c25baf813ff\f\SgrmBroker.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mobsyncexe_31bf3856ad364e35_10.0.19041.1_none_af96916428136673\mobsync.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_220320d2c4216035\TiWorker.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_wp.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-i..atedusermode-kernel_31bf3856ad364e35_10.0.19041.207_none_c5e1b9def3522696\f\securekernel.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.19041.1237_none_7578510aa0f564fa\f\vfpctrl.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tieringengine_31bf3856ad364e35_10.0.19041.1_none_6568d39003c9a6d5\TieringEngineService.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.19041.173_none_6486f23c2831aaf3\ScreenClipping\ScreenClippingHost.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wifinetworkmanager_31bf3856ad364e35_10.0.19041.84_none_6461f879a9c4a23e\f\wifitask.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-cttunesvr_31bf3856ad364e35_10.0.19041.746_none_d848cc62b1883bca\f\cttunesvr.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-s..chservice-component_31bf3856ad364e35_10.0.19041.1266_none_2262e67641106c48\r\SpeechRuntime.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bioenrollment.appxmain_31bf3856ad364e35_10.0.19041.844_none_de5d9fe254d9f8c4\r\BioEnrollmentHost.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filehistory-ui_31bf3856ad364e35_10.0.19041.746_none_2c2bcd67e9d4665c\FileHistory.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ndation-frameserver_31bf3856ad364e35_10.0.19041.1266_none_2a87945d79cbf905\f\FsIso.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-com-complus-ui_31bf3856ad364e35_10.0.19041.1_none_70ed7b8b1bf6d9d4\dcomcnfg.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..-management-console_31bf3856ad364e35_10.0.19041.1_none_cfb902e649608730\mmc.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wow64-legacy_31bf3856ad364e35_10.0.19041.1023_none_6aeab5d4bd0371a8\f\setup16.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-diskraid_31bf3856ad364e35_10.0.19041.1_none_1b7ab1943757b81e\diskraid.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasclienttools_31bf3856ad364e35_10.0.19041.1266_none_ee614da092435ac4\f\rasdial.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1288_none_71734bf99a2a6955\UevTemplateConfigItemGenerator.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..tional-chinese-core_31bf3856ad364e35_10.0.19041.1_none_0f750b10a0559386\IMTCPROP.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.19041.1081_none_e836fc4ed2e2ecc1\r\SpeechModelDownload.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_multipoint-wmsuseragent_31bf3856ad364e35_10.0.19041.746_none_3ed4d566b640ef5b\r\WmsUserAgent.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.19041.964_none_dddeea757b7fbba7\sftp.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegAsm.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.19041.1288_none_3f2d1be96237886e\r\wsmprovhost.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-netplwiz-exe_31bf3856ad364e35_10.0.19041.1_none_ad9c6c9be4203192\Netplwiz.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.19041.1110_none_b678ec2deb73b201\f\msra.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-narrator_31bf3856ad364e35_10.0.19041.84_none_b5c0f628d1d661eb\Narrator.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-provisioning-platform_31bf3856ad364e35_10.0.19041.844_none_487fcc4fe2c3cfbb\provlaunch.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..pdate-oob-component_31bf3856ad364e35_10.0.19041.84_none_e539abe3d27f675f\f\rdvgm.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tabletpc-controlpanel_31bf3856ad364e35_10.0.19041.1_none_95647fabfa4ec9fe\tabcal.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..line-user-interface_31bf3856ad364e35_10.0.19041.1_none_9d2d2a9ab0964bc3\cmdkey.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-browser-brokers_31bf3856ad364e35_11.0.19041.746_none_581ccf386ba57d51\browser_broker.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-cttune_31bf3856ad364e35_10.0.19041.1_none_73ca4447924360c1\cttune.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.1202_none_23a707c9a0b5a8e1\f\LaunchTM.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ribbons_31bf3856ad364e35_10.0.19041.1_none_3ea5f185c75971c2\Ribbons.scr- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..rvices-sessionagent_31bf3856ad364e35_10.0.19041.1_none_31431424ec14de3f\RdpSa.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_netfx35cdf-csd_cdf_installer_31bf3856ad364e35_10.0.19041.1_none_0e4d25c8cb52f8d0\WFServicesReg.exe- 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_8e2948a9ee2df05195f39f1f78e5229e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:832
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 9.5MB
- SHA256 6b538545202906e7bd6b6672e5987ee78c0d715f37b0fa44931e64b96456839a
- MD5 27b79dac0e456d8b9eda52368ee1d9b5
- SHA1 be26a11979f40b5c739e57a9210b4969c1952222
- SHA512 255991a4c2e829488857bff53b7942eadb7cb43e68fb76a8632f7aa042b954c26ec460875eae42760045577556277e8ebda6fea71a9257565008d38db4715a97
- SSDEEP 98304:lhpBinjOykGcIBdAWQtZ/K0tGOFWVRuQgLapI1D8joGjou:TpAnjOynBdAWyZ/K0ttYVAQgcI1ioQou
- TLSH T115A67D12F2A00276D066D075CB969725EBB13C694BF0D2DB6244B3D92F33BD1B63A721
- MD5 SHA1 SHA512 SSDEEP TLSH