Analysis
- max time kernel
149s - max time network
130s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
11/05/2026, 18:06
Behavioral task
behavioral1
Sample
2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe
- Size 14.2MB
- Sample260511-wp25haf17w
- SHA256 261fbc4772b3ca083bf54545a70c2d50f1ec1abaece680d79e0fdaf7bebbecea
- MD5 19e644d1d340c86ebf9101b5ca455aab
- SHA1 b8c39f94b9007c05e90eedb9df81b45e73338485
- SHA512 25698ef7aa884ed8c1d96a80e2050042a586b7fdc6b13c45d1cd34879864680435730292cea8cb184f53f27865e665bbd30828f641aa11dd0cbd7c1e09551ace
- SSDEEP 196608:ZaHxXME6o966HtIto0Ap6g5qPKrduEU8IBtzno+:ERXMzn6YoIgoEU8IBJo+
- TLSH T1CDE65B55F27622BDC127C178C09A9A37F93038451B208EFB5589F6742E37AE4993EB31
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\instnm.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\label.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\net1.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\gpupdate.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\MuiUnattend.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\perfhost.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\runas.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\scrnsave.scr 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\secinit.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\shutdown.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\chcp.com 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\chkntfs.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\poqexec.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\Robocopy.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\tcmsetup.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\wextract.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\at.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\dccw.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\edpnotify.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\tar.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\TSTheme.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\Utilman.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\verifiergui.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\OneDriveSetup.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\openfiles.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\printui.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\setx.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\shutdown.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\winver.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\cmdl32.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\convert.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\mtstocom.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\nslookup.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\RmClient.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\secinit.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\WerFault.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\wlanext.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\PING.EXE- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\winrs.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\xcopy.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\fltMC.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\RpcPing.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\tttracer.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\autochk.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\format.com- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\Magnify.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\mountvol.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\sc.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\sdiagnhost.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\xwizard.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\lodctr.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe -
resource yara_rule behavioral1/memory/3744-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/files/0x00120000000242b7-5.dat upx behavioral1/memory/3744-512-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/3744-3208-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Windows Media Player\setup_wm.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\uninstall.cmd 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Windows Mail\wabmig.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Windows Media Player\wmprph.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-quickassist_31bf3856ad364e35_10.0.19041.1_none_b3f1d9ff0e206c99\quickassist.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-x..jectdialog.appxmain_31bf3856ad364e35_10.0.19041.423_none_d93ee361fbbc8f0a\r\XGpuEjectDialog.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-provisioning-platform_31bf3856ad364e35_10.0.19041.844_none_52d476a2172491b6\provlaunch.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\x86_netfx-mscorsvw_exe_b03f5f7f11d50a3a_10.0.19041.1_none_e0dec3877978d84a\mscorsvw.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..b-standardcollector_31bf3856ad364e35_10.0.19041.264_none_0f23d07ed2574292\f\DiagnosticsHub.StandardCollector.Service.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filehistory-core_31bf3856ad364e35_10.0.19041.1110_none_29d8ec742bfd8b13\fhmanagew.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-oobe-machine_31bf3856ad364e35_10.0.19041.1266_none_82441dbab862ff6a\msoobe.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.19041.1288_none_4b1349ab76b8812f\spoolsv.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..cecontroller-minwin_31bf3856ad364e35_10.0.19041.1_none_f509d2f29c00c5f0\services.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.19041.264_none_8bd2f5fc0c992e06\SearchIndexer.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_10.0.19041.1237_none_556ba5d1df8130ac\f\printui.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..ter-cimprovider-exe_31bf3856ad364e35_10.0.19041.1_none_238f55dfbfb45941\Register-CimProvider.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wordpad_31bf3856ad364e35_10.0.19041.1_none_ee00310940a3cd37\wordpad.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_netfx4-mscorsvw_exe_b03f5f7f11d50a3a_4.0.15805.0_none_7d38f956251354fe\mscorsvw.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.19041.964_none_dddeea757b7fbba7\f\ssh-keyscan.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_adobe-flash-for-windows_31bf3856ad364e35_10.0.19041.82_none_2dad4b68cbfd8794\FlashPlayerApp.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-gdi_31bf3856ad364e35_10.0.19041.264_none_87b4b95ab967b582\f\fontdrvhost.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.19041.906_none_23e2379a6f03d0cb\r\gpresult.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-admincmdtools_31bf3856ad364e35_10.0.19041.1_none_6a9f2a3a3265ab31\showmount.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shellhost_31bf3856ad364e35_10.0.19041.746_none_f47187f881cbaf7d\sihost.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..commandlinetoolsmqq_31bf3856ad364e35_10.0.19041.1_none_df1a7ee54b62a4fd\msg.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_windows-defender-offline-amcore_31bf3856ad364e35_10.0.19041.1202_none_b9662ef4fe1412ad\OfflineScannerShell.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-restartmanager_31bf3856ad364e35_10.0.19041.1_none_407b1fa0f7dce496\RmClient.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-scripting_31bf3856ad364e35_10.0.19041.1237_none_c77fb947e9eed73b\f\wscript.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.19041.1151_none_fbdc4c5f677dc2ec\f\HvsiSettingsWorker.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-r..ckgroundmediaplayer_31bf3856ad364e35_10.0.19041.1266_none_3b00801193b15c0f\Windows.Media.BackgroundPlayback.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\DataSvcUtil.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.19041.1_none_0bc0f3d4cd7dc8fd\CExecSvc.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-spectrum_31bf3856ad364e35_10.0.19041.1151_none_f0b5afbf42eaff75\Spectrum.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-netsh_31bf3856ad364e35_10.0.19041.1_none_1fe6ae13cb971ac8\netsh.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sethc_31bf3856ad364e35_10.0.19041.746_none_4b0e3418084b5511\EaseOfAccessDialog.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\f\AppVStreamingUX.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-explorer_31bf3856ad364e35_10.0.19041.1266_none_c67a7a982eedc4e8\f\explorer.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wimgapi_31bf3856ad364e35_10.0.19041.1202_none_fdbbcf53ca14e151\f\wimserv.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_security-octagon-broker_31bf3856ad364e35_10.0.19041.546_none_380485edeba9f4c4\r\SgrmBroker.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_security-octagon-broker_31bf3856ad364e35_10.0.19041.84_none_51ae5c25baf813ff\SgrmBroker.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bits-bitsadmin_31bf3856ad364e35_10.0.19041.1_none_03029e85abc99279\bitsadmin.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pcwdiagnostic_31bf3856ad364e35_10.0.19041.1_none_ab1cdb679f059ace\pcwrun.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-autochk_31bf3856ad364e35_10.0.19041.1266_none_610e6b21ab533b13\autochk.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-parentalcontrols-ots_31bf3856ad364e35_10.0.19041.1052_none_073e2a212d1697e6\ApproveChildRequest.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..onwakesettingflyout_31bf3856ad364e35_10.0.19041.746_none_8a469514405342ff\PasswordOnWakeSettingFlyout.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_windows-gaming-xbox..e-service-component_31bf3856ad364e35_10.0.19041.264_none_31474dbf12ce5adc\r\XblGameSaveTask.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mapi_31bf3856ad364e35_10.0.19041.423_none_93adcfb5ace23a89\f\fixmapi.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskapilibrary_31bf3856ad364e35_10.0.19041.1266_none_622873cfbda33994\f\convertvhd.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-u..iedwritefilter-mgmt_31bf3856ad364e35_10.0.19041.1266_none_41843efc8f66bc7c\f\uwfmgr.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..alenrollmentmanager_31bf3856ad364e35_10.0.19041.264_none_839983ebef167c68\r\CredentialEnrollmentManager.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-complus-ui_31bf3856ad364e35_10.0.19041.746_none_8ea10e81a707d623\dcomcnfg.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mdmagent_31bf3856ad364e35_10.0.19041.1_none_faedbaa2bd7d01c2\MDMAgent.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-openwith_31bf3856ad364e35_10.0.19041.1_none_2311dc3012116c15\OpenWith.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..oler-filterpipeline_31bf3856ad364e35_10.0.19041.867_none_099246ae3a45708c\r\printfilterpipelinesvc.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_netfx35linq-vb_compiler_orcas_31bf3856ad364e35_10.0.19041.1_none_4bf3621a8ebe2ee3\vbc.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.1_none_7862ecae0548fb54\shrpubw.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1_none_b29cb2f3845833b7\UevTemplateBaselineGenerator.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-efs-ui_31bf3856ad364e35_10.0.19041.1_none_ac65d58626f4027c\efsui.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..kgroundtransferhost_31bf3856ad364e35_10.0.19041.746_none_6c7de5b30e8f6071\r\BackgroundTransferHost.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lications-clientsku_31bf3856ad364e35_10.0.19041.1_none_d4cc2ddce5811964\rdpshell.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..llshield-wow64-main_31bf3856ad364e35_10.0.19041.1_none_245e11de2a010b62\setup.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.1081_none_38869341091832be\mofcomp.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-embedded-shelllauncher_31bf3856ad364e35_10.0.19041.264_none_223a5768a6257099\ShellLauncherConfig.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-adminservice_31bf3856ad364e35_10.0.19041.1_none_1058f7ab971a5799\WMSvc.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1_none_97b0a47239f6db64\PeopleExperienceHost.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3744
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 14.7MB
- SHA256 12ee923f9fb619f9ea3d126f67fa1e18843b7dce886b3b932b8b88091ed77bd6
- MD5 4813e8efa964d3fb5a3bd6466ebe8d44
- SHA1 1435d955c9c098c1d7b68c5b3c3982fc53da4d34
- SHA512 fde742324c5039826ec841b48a0d6aa73e107c0ac225eaa34eb0148769f03dfc0f461c37a40489ffbdcd89d5b81e8b42997b52a891618b07e418eed57c329ef5
- SSDEEP 196608:ZaHxXME6o966HtIto0Ap6g5qPKrduEU8IBtznoEoK:ERXMzn6YoIgoEU8IBJo7K
- TLSH T1FEF65B55F27622BDC127C178C09A9A77F93038451B208EFB4189F6742E37AE5993EB31
- MD5 SHA1 SHA512 SSDEEP TLSH