Analysis
- max time kernel
149s - max time network
107s - platform
windows11-21h2_x64 - resource
win11-20250619-en - resource tags
arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system - submitted
11/05/2026, 13:34
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe
Resource
win10v2004-20250619-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe
Resource
win11-20250619-en
windows11-21h2-x64
5 signatures
150 seconds
General
- Target 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe
- Size 9.5MB
- Sample260511-qvctxabs5w
- SHA256 ce63029c5791d4aab168f8c4103f7097c4ccfdb59b7ea9e1450390907308a6a1
- MD5 509a6d736925153cac4d26788e9e7086
- SHA1 6a80ced986730ce980ff55ece600f4a5b467bfb5
- SHA512 225bf1e1b1d0cc467d6e1e4483e9c9976d05ed515b45f07f0993385c622162bcb5cca0d92475547722f1c857da86d8fa2120791376d3ce950a7e19dd0dfd846a
- SSDEEP 98304:khpBinjOykGcPdOR5faKUgTH2M2m9UMpu1QfLczqssnKSy:8pAnjOyAdOrfqgTH2qBpu1QfLIqsufy
- TLSH T181A6391162D58FADC05F9074CE4A66A15A237C958F31AFDF1980BE293E326F05E3921F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule behavioral2/files/0x002200000002ad3d-4.dat UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\NETSTAT.EXE 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\diskperf.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\esentutl.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\ieUnatt.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\isoburn.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\mobsync.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\cttune.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\provlaunch.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\driverquery.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\notepad.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\scrnsave.scr- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\bthudtask.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\dccw.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\cliconfg.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\dllhst3g.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\mode.com- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\more.com- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\msinfo32.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\SndVol.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\srdelayed.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\auditpol.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\mcbuilder.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\reg.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\SystemUWPLauncher.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\takeown.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\regedit.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\help.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\ROUTE.EXE 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\unlodctr.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\dxdiag.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\cmdkey.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\wextract.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\ARP.EXE 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\expand.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\mmc.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\sdiagnhost.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\wevtutil.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\winrm.cmd 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\ByteCodeGenerator.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\cacls.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\dpnsvr.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\rundll32.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\taskkill.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\winver.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\fltMC.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\getmac.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\dllhost.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\appidtel.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\eudcedit.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\logman.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevated_tracing_service.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.43\MicrosoftEdgeUpdate.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\msedge_pwa_launcher.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\msedgewebview2.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.69\pwahelper.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.43\MicrosoftEdgeComRegisterShellARM64.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Windows Media Player\wmlaunch.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.69\elevation_service.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Windows Mail\wab.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.69\elevation_service.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Windows Mail\wab.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\show_third_party_software_licenses.bat- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.22000.318_none_2bc95a47eaa37094\hvax64.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_10.0.22000.1_none_4374dc8b76e3bd2c\IMJPUEX.EXE- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-clientcore_31bf3856ad364e35_10.0.22000.348_none_a83a13d7c7ca92d4\f\nfsclnt.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-previewhost_31bf3856ad364e35_10.0.22000.1_none_998102c905a7b94f\prevhost.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tapisetup_31bf3856ad364e35_10.0.22000.1_none_c036c8699ff31951\TapiUnattend.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_netfx35linq-addinprocess_31bf3856ad364e35_10.0.22000.1_none_86dac86e5184145e\AddInProcess.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devicecensus_31bf3856ad364e35_10.0.22000.120_none_aad7a0687fb44b43\DeviceCensus.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.22000.194_none_15db8cfb1c6a6b33\SystemSettings.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_10.0.22000.1_none_0bfef7470a16d155\svchost.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.318_none_82292a5c4e657627\SearchHost.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\x86_wpf-xamlviewer_31bf3856ad364e35_10.0.22000.1_none_50334ea3c95884c9\XamlViewer_v0300.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..ative-serverbox-isv_31bf3856ad364e35_10.0.22000.120_none_f07c0067839c600d\f\RMActivate_ssp_isv.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.22000.1_none_d3608b4d6c1da7eb\mode.com- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-twinui_31bf3856ad364e35_10.0.22000.132_none_7958838972f5ba04\r\LaunchWinApp.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-verclsid_31bf3856ad364e35_10.0.22000.1_none_1c7f192e4c9e218b\verclsid.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\x86_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_10.0.22000.1_none_aef18f12e09924ba\aspnet_regiis.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\x86_netfx4-aspnet_state_exe_b03f5f7f11d50a3a_4.0.15806.0_none_a7aaeeef36301964\aspnet_state.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.22000.376_none_a359e3d81485694b\f\SenseNdr.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-browser-brokers_31bf3856ad364e35_11.0.22000.1_none_c0a088f7530491ea\browserexport.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..structureexecutable_31bf3856ad364e35_10.0.22000.1_none_4e4c1e255ad155f3\lodctr.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.22000.376_none_d180c9ec46d962eb\spoolsv.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-c..mplus-admin-comrepl_31bf3856ad364e35_10.0.22000.1_none_4aa1c639c898ed19\comrepl.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\WebExperienceHostApp.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lsa-minwin_31bf3856ad364e35_10.0.22000.282_none_3891f56e17aabe62\lsass.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-verclsid_31bf3856ad364e35_10.0.22000.1_none_122a6edc183d5f90\verclsid.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-x..rtificateenrollment_31bf3856ad364e35_10.0.22000.434_none_eef51ebf13d8d8a1\CertEnrollCtrl.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft.windows.winhttp_31bf3856ad364e35_5.1.22000.1_none_9e1105ca4c207d1b\pacjsworker.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wab-app_31bf3856ad364e35_10.0.22000.1_none_a341a57910bc73cd\wab.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.22000.318_none_2bc95a47eaa37094\f\hvax64.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.22000.318_none_c7ea7e014d4524f4\r\ScriptRunner.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..monotificationuxexe_31bf3856ad364e35_10.0.22000.282_none_618940d4a376d501\f\MoNotificationUx.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wab-app_31bf3856ad364e35_10.0.22000.1_none_98ecfb26dc5bb1d2\wabmig.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-fsutil_31bf3856ad364e35_10.0.22000.282_none_d1df129ba9a9b56f\fsutil.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..mpropertieshardware_31bf3856ad364e35_10.0.22000.1_none_a192cd380c242ff3\SystemPropertiesHardware.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..ommandline-repadmin_31bf3856ad364e35_10.0.22000.434_none_a003f3391feff8a5\repadmin.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\DataSvcUtil.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\x86_microsoft-windows-s..or-native-serverbox_31bf3856ad364e35_10.0.22000.120_none_0f0554e930e1de1c\f\RMActivate_ssp.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ice-remoteposworker_31bf3856ad364e35_10.0.22000.1_none_75c3533c7b92f5af\RemotePosWorker.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.22000.282_none_c58bc93032642398\winrm.cmd- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-compat-compattelrunner_31bf3856ad364e35_10.0.22000.1_none_156c36971612d61e\CompatTelRunner.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eventcreate_31bf3856ad364e35_10.0.22000.1_none_2ba66e4a445cef6c\eventcreate.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-os-kernel-la57_31bf3856ad364e35_10.0.22000.318_none_47eee9eaf8f3237f\ntkrla57.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rpc-ping_31bf3856ad364e35_10.0.22000.1_none_f3fdabb645819748\RpcPing.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rundll32_31bf3856ad364e35_10.0.22000.1_none_2e48ef35afb3a654\rundll32.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_netfx-ieexec_b03f5f7f11d50a3a_10.0.22000.1_none_463f193e37cf0011\IEExec.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-netsh_31bf3856ad364e35_10.0.22000.1_none_c0393e363102a7bd\netsh.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-embedded-shelllauncher_31bf3856ad364e35_10.0.22000.120_none_3fbde764cc71982b\r\eshell.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.22000.282_none_81f8a77609cf735a\MoUsoCoreWorker.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_netfx4-vbc_exe_b03f5f7f11d50a3a_4.0.15806.0_none_96eed05805687d60\vbc.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.22000.348_none_5519d2fa88b436fc\SearchFilterHost.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-userinit_31bf3856ad364e35_10.0.22000.37_none_be275aadedb23f4a\f\userinit.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.22000.348_none_6b5eb3c4c1ffcde9\f\WerFault.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ieframe_31bf3856ad364e35_11.0.22000.348_none_a3b217b55cca1de2\f\IESettingSync.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.280_none_0483b4854ca89ef9\TiWorker.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.22000.1_none_c1bbc2c937fef3c3\relog.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\csc.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..ment-windows-minwin_31bf3856ad364e35_10.0.22000.469_none_4b2e9fd5814459a0\f\winload.exe- 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_509a6d736925153cac4d26788e9e7086_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4392
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 10.0MB
- SHA256 2c7a49356f506b4df4e914bb836849c199879b7e2ac4ed696d84344f6b31e31c
- MD5 a500b0bee0d1c3e289a40ff8d6b875df
- SHA1 9bb8533ed1129dd6ad7b83ed9e9e554d4861a899
- SHA512 2e74d1ba63e12973f1a37effaa39abe89c5adc2eef5f0e0f9cb2223a3bfd5e5c62f637dc87ab1b40cd09b8853fdb0c6d1aad3a6fb8e5838d997d668d52bc6fda
- SSDEEP 196608:8pAnjOyAdOrfqgTH2qBpu1QfLIqsuf4oY:OAntTHNBpu1Qfc03Y
- TLSH T14FB6391162D58FADC05FD074CE4666A1AA237C954F319FDF1A80BE293E326E05E3921F
- MD5 SHA1 SHA512 SSDEEP TLSH