Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
11/05/2026, 18:06
Behavioral task
behavioral1
Sample
2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe
- Size 14.2MB
- Sample260511-wp25haf17w
- SHA256 261fbc4772b3ca083bf54545a70c2d50f1ec1abaece680d79e0fdaf7bebbecea
- MD5 19e644d1d340c86ebf9101b5ca455aab
- SHA1 b8c39f94b9007c05e90eedb9df81b45e73338485
- SHA512 25698ef7aa884ed8c1d96a80e2050042a586b7fdc6b13c45d1cd34879864680435730292cea8cb184f53f27865e665bbd30828f641aa11dd0cbd7c1e09551ace
- SSDEEP 196608:ZaHxXME6o966HtIto0Ap6g5qPKrduEU8IBtzno+:ERXMzn6YoIgoEU8IBJo+
- TLSH T1CDE65B55F27622BDC127C178C09A9A37F93038451B208EFB5589F6742E37AE4993EB31
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\cmdl32.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\wermgr.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\cttune.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\diskpart.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\doskey.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\esentutl.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\eventvwr.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\fixmapi.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\makecab.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\srdelayed.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\ktmutil.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\RpcPing.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\Taskmgr.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\TCPSVCS.EXE- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\upnpcont.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\verifiergui.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\print.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\xwizard.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\calc.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\cttunesvr.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\mavinject.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\Speech_OneCore\Common\SpeechModelDownload.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\SystemUWPLauncher.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\wsmprovhost.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\fontview.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\whoami.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\lodctr.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\netiougc.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\regsvr32.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\unlodctr.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\waitfor.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\esentutl.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\mfpmp.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\PkgMgr.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\certutil.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\mfpmp.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\printui.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\ReAgentc.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\cmmon32.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\netiougc.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\netsh.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\cmdl32.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\odbcad32.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\explorer.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\fontview.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\sort.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\forfiles.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\ipconfig.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\resmon.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\runonce.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\sc.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\subst.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\tzutil.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\user.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\colorcpl.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe -
resource yara_rule behavioral2/memory/3560-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/files/0x001e00000002b0b0-5.dat upx behavioral2/memory/3560-550-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/3560-3182-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Mozilla Firefox\updater.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Windows Media Player\wmlaunch.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Windows Media Player\wmpshare.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateOnDemand.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Windows Media Player\wmprph.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Mozilla Firefox\firefox.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.22000.348_none_1cb0f82bf1aef3cc\f\lpremove.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ndation-frameserver_31bf3856ad364e35_10.0.22000.469_none_b104ba5249e06dec\FsIso.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-customshellhost_31bf3856ad364e35_10.0.22000.120_none_83fc3979242f7e2e\r\CustomShellHost.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..snotificationbroker_31bf3856ad364e35_10.0.22000.37_none_46638c67a45b1942\r\MusNotification.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.22000.1_none_097d69edf72fd893\mavinject.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.22000.469_none_f7ee9eea6a40784c\UevAgentPolicyGenerator.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.22000.469_none_5669b3acf1ecab58\winresume.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..or-native-serverbox_31bf3856ad364e35_10.0.22000.120_none_6b23f06ce93f4f52\r\RMActivate_ssp.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.22000.318_none_9b6af6ae8c0ac6cb\f\dtdump.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.318_none_82292a5c4e657627\n\MiniSearchHost.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_multipoint-wmssvc_31bf3856ad364e35_10.0.22000.1_none_170791d396c16360\WmsSvc.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet_state_exe_b03f5f7f11d50a3a_10.0.22000.1_none_d639883a6cfed852\aspnet_state.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\jsc.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\ScreenClippingHost.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..onment-core-tcbboot_31bf3856ad364e35_10.0.22000.318_none_fbf48b4fce07c440\tcblaunch.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.22000.282_none_6b2d7072c225a87c\WerFaultSecure.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filepicker.appxmain_31bf3856ad364e35_10.0.22000.120_none_bdd6ed7a5949f71c\f\FilePicker.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.22000.318_none_2da4853532607174\r\AuditShD.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-taskkill_31bf3856ad364e35_10.0.22000.1_none_7bc19cab60d99f6f\taskkill.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.22000.282_none_555ad0e288836a51\r\SearchFilterHost.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regsql.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CasPol.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-es-authentication_31bf3856ad364e35_10.0.22000.1_none_98005a471b61ee29\EhStorAuthn.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-optionalfeatures_31bf3856ad364e35_10.0.22000.1_none_bcaa97eff2780373\OptionalFeatures.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..tionsimulationinput_31bf3856ad364e35_10.0.22000.120_none_6698726619b2ab7a\r\PerceptionSimulationInput.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ping-utilities_31bf3856ad364e35_10.0.22000.1_none_ff7542ad94a3dbc5\PATHPING.EXE- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_netfx-ngen_exe_b03f5f7f11d50a3a_10.0.22000.1_none_ccd97e50f4c65861\ngen.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..me-japanese-setting_31bf3856ad364e35_10.0.22000.1_none_12c84018b608c95b\IMJPSET.EXE- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-smartscreen_31bf3856ad364e35_10.0.22000.65_none_9f7612893c144c09\f\smartscreen.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.22000.376_none_a359e3d81485694b\SenseCncProxy.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..player-shellpreview_31bf3856ad364e35_10.0.22000.1_none_21361b29ac61361b\wmprph.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_10.0.22000.1_none_5a923992d494427e\dplaysvr.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\x86_netfx4-mscorsvw_exe_b03f5f7f11d50a3a_4.0.15806.256_none_bd4110e80daed286\mscorsvw.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-host-service_31bf3856ad364e35_10.0.22000.376_none_f2dd928d310396ab\f\vmcompute.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..pgrade-subscription_31bf3856ad364e35_10.0.22000.1_none_a7b29fe42d04be58\ClipRenew.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bioenrollment.appxmain_31bf3856ad364e35_10.0.22000.120_none_fbcb84a27b36694e\r\BioEnrollmentHost.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..n-tools-command-ldp_31bf3856ad364e35_10.0.22000.434_none_4a9fb8788572dd19\r\ldp.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..tional-chinese-core_31bf3856ad364e35_10.0.22000.1_none_afc79b3305c1207b\IMTCPROP.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lockapp.appxmain_31bf3856ad364e35_10.0.22000.282_none_e2966659594e32a5\f\LockApp.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.22000.282_none_d171f6f246e51c59\r\splwow64.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ces-workspacebroker_31bf3856ad364e35_10.0.22000.282_none_8a68951ea6251dba\r\wkspbroker.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.22000.318_none_9b6af6ae8c0ac6cb\r\runexehelper.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ktmutil_31bf3856ad364e35_10.0.22000.1_none_e92240163a52addb\ktmutil.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediafoundation_31bf3856ad364e35_10.0.22000.120_none_a2190a6cc64fec46\f\mfpmp.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-autoplay_31bf3856ad364e35_10.0.22000.1_none_7b92f89679249548\wmlaunch.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.22000.282_none_10e4c14208d6d2d3\r\wmplayer.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-r..sistance-dcomserver_31bf3856ad364e35_10.0.22000.71_none_1c87d1fdc5c5037f\f\raserver.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-x..rtificateenrollment_31bf3856ad364e35_10.0.22000.1_none_542efeeac7d0b582\CertEnrollCtrl.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-servicing_31bf3856ad364e35_10.0.22000.194_none_213203c52af71b4b\f\bfsvc.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-setup-support_31bf3856ad364e35_11.0.22000.348_none_04e0603a0d245e07\ie4ushowIE.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-xbox-gamecallableui.appxmain_31bf3856ad364e35_10.0.22000.120_none_1e850fa96c804e78\XBox.TCUI.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_windows-application..egistrationverifier_31bf3856ad364e35_10.0.22000.1_none_dd3404b7c9d94b9f\AppHostRegistrationVerifier.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..pertiescomputername_31bf3856ad364e35_10.0.22000.1_none_910b7a497567d369\SystemPropertiesComputerName.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.22000.282_none_78d41497d781352f\r\SpeechModelDownload.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.1_none_0384636b13b61c9e\TiFileFetcher.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SystemApps\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\CHXSmartScreen.exe 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.493_none_81cdab704eaad423\ScreenClippingHost.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft.powershell.pester_31bf3856ad364e35_10.0.22000.1_none_2a76084a7899eecf\Build.bat- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-com-complus-ui_31bf3856ad364e35_10.0.22000.1_none_11400bad816266c9\dcomcnfg.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..structure-minkernel_31bf3856ad364e35_10.0.22000.1_none_398d4981eff37ba2\perfhost.exe- 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_19e644d1d340c86ebf9101b5ca455aab_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3560
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 14.7MB
- SHA256 12ee923f9fb619f9ea3d126f67fa1e18843b7dce886b3b932b8b88091ed77bd6
- MD5 4813e8efa964d3fb5a3bd6466ebe8d44
- SHA1 1435d955c9c098c1d7b68c5b3c3982fc53da4d34
- SHA512 fde742324c5039826ec841b48a0d6aa73e107c0ac225eaa34eb0148769f03dfc0f461c37a40489ffbdcd89d5b81e8b42997b52a891618b07e418eed57c329ef5
- SSDEEP 196608:ZaHxXME6o966HtIto0Ap6g5qPKrduEU8IBtznoEoK:ERXMzn6YoIgoEU8IBJo7K
- TLSH T1FEF65B55F27622BDC127C178C09A9A77F93038451B208EFB4189F6742E37AE5993EB31
- MD5 SHA1 SHA512 SSDEEP TLSH