Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20250619-en - resource tags
arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system - submitted
11/05/2026, 13:34
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe
Resource
win10v2004-20250619-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe
Resource
win11-20250619-en
windows11-21h2-x64
5 signatures
150 seconds
General
- Target 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe
- Size 9.5MB
- Sample260511-qvctxabs5w
- SHA256 ce63029c5791d4aab168f8c4103f7097c4ccfdb59b7ea9e1450390907308a6a1
- MD5 509a6d736925153cac4d26788e9e7086
- SHA1 6a80ced986730ce980ff55ece600f4a5b467bfb5
- SHA512 225bf1e1b1d0cc467d6e1e4483e9c9976d05ed515b45f07f0993385c622162bcb5cca0d92475547722f1c857da86d8fa2120791376d3ce950a7e19dd0dfd846a
- SSDEEP 98304:khpBinjOykGcPdOR5faKUgTH2M2m9UMpu1QfLczqssnKSy:8pAnjOyAdOrfqgTH2qBpu1QfLIqsufy
- TLSH T181A6391162D58FADC05F9074CE4A66A15A237C958F31AFDF1980BE293E326F05E3921F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule behavioral1/files/0x00050000000229b1-4.dat UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\systeminfo.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\wiaacmgr.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\ipconfig.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\msra.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\takeown.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\dccw.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\logman.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\perfmon.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\printui.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\rrinstaller.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\wlanext.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\choice.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\dplaysvr.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\fsquirt.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\getmac.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\hh.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\makecab.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\OpenWith.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\cmdkey.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\cttunesvr.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\getmac.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\mmc.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\upnpcont.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\write.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\wusa.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\convert.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\explorer.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\LaunchTM.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\winrshost.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\chkdsk.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\instnm.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\ReAgentc.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\w32tm.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\cacls.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\relog.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\sort.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\autochk.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\clip.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\forfiles.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\Msdtc\Trace\msdtcvtr.bat- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\proquota.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\taskkill.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\winrs.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\efsui.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\odbcad32.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\chkntfs.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\powercfg.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\schtasks.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\logagent.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\schtasks.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\tree.com 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\ieUnatt.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\RpcPing.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\where.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Google\Chrome\Application\133.0.6943.60\chrome_pwa_launcher.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\7-Zip\7zG.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.61\MicrosoftEdgeUpdateSetup.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\msedge.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-defrag-cmdline_31bf3856ad364e35_10.0.19041.746_none_a5751a882524bee1\f\Defrag.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_11.0.19041.1202_none_5b834788c0d17953\iexplore.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..switch-toasthandler_31bf3856ad364e35_10.0.19041.746_none_b2e64138c9682982\InputSwitchToastHandler.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\x86_microsoft-windows-i..devicescontrolpanel_31bf3856ad364e35_10.0.19041.1_none_7e723dd43021c2d3\ImagingDevices.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..csengine-nativehost_31bf3856ad364e35_10.0.19041.1_none_d016f232fbeefbad\sdiagnhost.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.19041.264_none_64b3f487e354744d\r\usocoreworker.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\vbc.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..tnet-mua-hostserver_31bf3856ad364e35_10.0.19041.746_none_b93dce693a9c6db9\WinRTNetMUAHostServer.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appid_31bf3856ad364e35_10.0.19041.1202_none_cc0c3d35675da3a1\f\appidcertstorecheck.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.19041.1266_none_07a5d18b92d8b668\f\cmproxyd.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-adamsync_31bf3856ad364e35_10.0.19041.1081_none_6700b2d2d3c0055f\adamsync.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-musnotifyiconexe_31bf3856ad364e35_10.0.19041.1266_none_adfc223229a335a6\f\MusNotifyIcon.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-gdi_31bf3856ad364e35_10.0.19041.1165_none_28f87d0444103fde\fontdrvhost.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-net1-command-line-tool_31bf3856ad364e35_10.0.19041.844_none_6f27e9e1e7c4fb87\f\net1.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-securitycenter-core_31bf3856ad364e35_10.0.19041.1081_none_9972edde9b98690c\wscadminui.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..ing-platform-client_31bf3856ad364e35_10.0.19041.1266_none_7e2b6be969016c27\r\licensingdiag.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-scripting_31bf3856ad364e35_10.0.19041.1237_none_bd2b0ef5b58e1540\wscript.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-usoclient_31bf3856ad364e35_10.0.19041.1_none_64d9c601341de377\UsoClient.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-onlinesetup-component_31bf3856ad364e35_10.0.19041.746_none_4b0a936d86cdd479\r\oobeldr.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..ommandline-repadmin_31bf3856ad364e35_10.0.19041.1_none_5a9698f03a1b8696\repadmin.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\notepad.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-d..s-vmswitch-netsetup_31bf3856ad364e35_10.0.19041.264_none_62496caeba2daa52\nvspinfo.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-coredpussvr_31bf3856ad364e35_10.0.19041.746_none_7946fb11bf19dc87\f\coredpussvr.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-net-command-line-tool_31bf3856ad364e35_10.0.19041.1_none_08235f0411d49656\net.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.264_none_0e32f443c4669fed\hvax64.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wow64-legacy_31bf3856ad364e35_10.0.19041.1023_none_6aeab5d4bd0371a8\r\setup16.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_regasm_b03f5f7f11d50a3a_10.0.19041.1_none_904f8b459208b3ae\RegAsm.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-runas_31bf3856ad364e35_10.0.19041.1_none_15d956c7fccae922\runas.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.746_none_e2c6a972a81b8d2c\f\icsunattend.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoftwindows-undockeddevkit.appxmain_31bf3856ad364e35_10.0.19041.488_none_7201e1dc944d1765\UndockedDevKit.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-extrac32_31bf3856ad364e35_10.0.19041.1_none_9b6f5274d7a3ac24\extrac32.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-u..ountcontrolsettings_31bf3856ad364e35_10.0.19041.1_none_43eac9c1ac59d1f0\UserAccountControlSettings.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..ing-management-core_31bf3856ad364e35_10.0.19041.746_none_ad0ed54dd130eec3\DismHost.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.19041.746_none_770f598aef14382e\f\dfrgui.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dxp-deviceexperience_31bf3856ad364e35_10.0.19041.746_none_251e769058968366\r\Dxpserver.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-unifiedwritefilter_31bf3856ad364e35_10.0.19041.1266_none_110072d23cfc00d3\UwfServicingSvc.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filehistory-ui_31bf3856ad364e35_10.0.19041.1_none_0423901f2a62a812\FileHistory.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-quickassist_31bf3856ad364e35_10.0.19041.1_none_b3f1d9ff0e206c99\quickassist.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_9aa166e99861c2bc\change.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lications-clientsku_31bf3856ad364e35_10.0.19041.1266_none_93a0f3defb54e912\rdpshell.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_10.0.19041.746_none_d22800313aa7eb5c\regedit.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-starttiledata_31bf3856ad364e35_10.0.19041.264_none_6ea6dfb6393e5f06\r\DataStoreCacheDumpTool.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sxs_31bf3856ad364e35_10.0.19041.746_none_8c45e6e8b672ffff\sxstrace.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sysprep_31bf3856ad364e35_10.0.19041.746_none_cd77eb91574a2623\r\sysprep.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-waasmedic_31bf3856ad364e35_10.0.19041.207_none_11794cc79cc85d1d\r\WaaSMedicAgent.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.1081_none_ef39acce2648e404\f\WerFault.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ie-impexp-extexport_31bf3856ad364e35_11.0.19041.1_none_bbc1ad79155f896a\ExtExport.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallUtil.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SystemApps\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\CHXSmartScreen.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_ef0e010d1381269b\aspnetca.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mapi-mmga_31bf3856ad364e35_10.0.19041.746_none_b4441130315b5f1f\f\mmgaserver.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_windows-shield-provider_31bf3856ad364e35_10.0.19041.1266_none_1abb9653828c3f41\SecurityHealthHost.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.1202_none_2dfbb21bd5166adc\r\Taskmgr.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-webcamexperience_31bf3856ad364e35_10.0.19041.746_none_5536c5683efe1dad\f\CameraSettingsUIHost.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegAsm.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-usoclient_31bf3856ad364e35_10.0.19041.1266_none_23ae8c0349f1b325\UsoClient.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..pertiescomputername_31bf3856ad364e35_10.0.19041.1_none_f0b8ea270ffc4674\SystemPropertiesComputerName.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systray_31bf3856ad364e35_10.0.19041.1_none_a9428a56956799d8\systray.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-r..sistance-dcomserver_31bf3856ad364e35_10.0.19041.1110_none_af1474f55f209109\raserver.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3948
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 10.0MB
- SHA256 2c7a49356f506b4df4e914bb836849c199879b7e2ac4ed696d84344f6b31e31c
- MD5 a500b0bee0d1c3e289a40ff8d6b875df
- SHA1 9bb8533ed1129dd6ad7b83ed9e9e554d4861a899
- SHA512 2e74d1ba63e12973f1a37effaa39abe89c5adc2eef5f0e0f9cb2223a3bfd5e5c62f637dc87ab1b40cd09b8853fdb0c6d1aad3a6fb8e5838d997d668d52bc6fda
- SSDEEP 196608:8pAnjOyAdOrfqgTH2qBpu1QfLIqsuf4oY:OAntTHNBpu1Qfc03Y
- TLSH T14FB6391162D58FADC05FD074CE4666A1AA237C954F319FDF1A80BE293E326E05E3921F
- MD5 SHA1 SHA512 SSDEEP TLSH