Analysis
- max time kernel
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
02/06/2026, 03:54
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win11-20260513-en
windows11-21h2-x64
5 signatures
150 seconds
General
- Target 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
- Size 4.3MB
- Sample260602-egd92aex3k
- SHA256 c9194e8ee70d09419778ad80bace1f4dbd8209d5d61cae404795f81aa2257aad
- MD5 9f5cc34b32ff972f5cfb936ebf823774
- SHA1 fce7be772aafd91e9df6ebbefd07dddcf8b38503
- SHA512 ccdd5253bc0617deee7627fc2065ffd40e75135e5243a51d284615e054b20c40203a0cb361f27a3a302c2460b79bef4b8ee17e1aee78b2547ef97f0418989a64
- SSDEEP 49152:kpPZuyWSG+BBvGvnjOyYVGlqRONszVBXdc/RJzVBXfqJtb2Ib+SVBXdci:khpBinjOykGcPdOR5fmd9
- TLSH T1B7269D06B3900277E0B39175C5AA5741DA7138781B31D3DB7388B65A2E337D29A3BB72
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule behavioral2/files/0x002c00000002b2a4-4.dat UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\sdbinst.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wevtutil.exe 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\fsquirt.exe 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\perfmon.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\bitsadmin.exe 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\driverquery.exe 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\edpnotify.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\forfiles.exe 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\mstsc.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\reg.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\regini.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\hh.exe 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\curl.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\diskpart.exe 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\fsutil.exe 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\proquota.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\sc.exe 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\AtBroker.exe 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\charmap.exe 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cmmon32.exe 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\dllhst3g.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ipconfig.exe 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\unregmp2.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\bthudtask.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cttunesvr.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\doskey.exe 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\rekeywiz.exe 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Robocopy.exe 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\RpcPing.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\sfc.exe 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\tzutil.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\calc.exe 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\edpnotify.exe 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\fsquirt.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\mountvol.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\upnpcont.exe 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wecutil.exe 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\eudcedit.exe 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\eventcreate.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\fltMC.exe 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\RmClient.exe 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\rundll32.exe 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\verclsid.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wextract.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\dccw.exe 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ddodiag.exe 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\icacls.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\netbtugc.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\nslookup.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\hh.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\RpcPing.exe 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SyncHost.exe 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\taskkill.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\tcmsetup.exe 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\TpmInit.exe 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\verifiergui.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Internet Explorer\iexplore.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\uninstall.cmd- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Windows Media Player\setup_wm.exe 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\show_third_party_software_licenses.bat 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\show_third_party_software_licenses.bat- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeComRegisterShellARM64.exe 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Windows Media Player\wmplayer.exe 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-lsa-minwin_31bf3856ad364e35_10.0.22000.434_none_38ca096a17805fa9\f\lsass.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_netfx35linq-vb_compiler_orcas_31bf3856ad364e35_10.0.22000.1_none_ec45f23cf429bbd8\vbc.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-commandprompt_31bf3856ad364e35_10.0.22000.1_none_eba50eb553865eda\cmd.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-label_31bf3856ad364e35_10.0.22000.1_none_b7c753c003725517\label.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.22000.376_none_a359e3d81485694b\f\SenseCE.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ment-userdatasource_31bf3856ad364e35_10.0.22000.51_none_47d05adb57cc60db\r\UserDataSource.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..perience-ait-static_31bf3856ad364e35_10.0.22000.1_none_872834aeb30e11cf\aitstatic.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_bsdtar_31bf3856ad364e35_10.0.22000.434_none_5be11e6025939378\tar.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.22000.1_none_ddb5359fa07e69e6\mode.com- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-u..onwakesettingflyout_31bf3856ad364e35_10.0.22000.1_none_0ce592401aadd3a5\PasswordOnWakeSettingFlyout.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-service_31bf3856ad364e35_10.0.22000.41_none_46e53612c0e92204\BdeUISrv.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\csc.exe 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wlan-extension_31bf3856ad364e35_10.0.22000.1_none_5026ccd428229c6c\wlanext.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..structure-minkernel_31bf3856ad364e35_10.0.22000.1_none_398d4981eff37ba2\perfhost.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\x86_aspnet_regbrowsers_b03f5f7f11d50a3a_10.0.22000.1_none_a631d85ed7b16283\aspnet_regbrowsers.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\AddInUtil.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-winre-tools_31bf3856ad364e35_10.0.22000.65_none_ac11e3d68c043701\f\BootRec.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SystemApps\Microsoft.AsyncTextService_8wekyb3d8bbwe\Microsoft.AsyncTextService.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filehistory-core_31bf3856ad364e35_10.0.22000.71_none_974c497c92a1fd89\fhmanagew.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-usoclient_31bf3856ad364e35_10.0.22000.469_none_aa2bb1f81a06280c\f\UsoClient.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-getmac_31bf3856ad364e35_10.0.22000.1_none_6c96deb2db24e7d4\getmac.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_product-containeros__windowssearchengine_31bf3856ad364e35_7.0.22000.348_none_2b1b00237ae1bbca\f\SearchIndexer.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ative-serverbox-isv_31bf3856ad364e35_10.0.22000.120_none_f07c0067839c600d\r\RMActivate_ssp_isv.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..vercommandlinetools_31bf3856ad364e35_10.0.22000.1_none_10872c88a98c0f77\flattemp.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msdt_31bf3856ad364e35_10.0.22000.1_none_061aa9eb56b04ee9\msdt.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-net-command-line-tool_31bf3856ad364e35_10.0.22000.1_none_b2ca9978aba0e546\net.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-xwizard-host-process_31bf3856ad364e35_10.0.22000.1_none_b98c58cb71adbfeb\xwizard.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ntalcontrolsmonitor_31bf3856ad364e35_10.0.22000.65_none_2d03a3ca59967a09\f\WpcMon.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..client-ui-wscollect_31bf3856ad364e35_10.0.22000.1_none_5ff70533364eab1d\WSCollect.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-robocopy_31bf3856ad364e35_10.0.22000.469_none_cc9ed34da60ac9c4\Robocopy.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\x86_regsvcs_b03f5f7f11d50a3a_10.0.22000.1_none_86f921f526968cd7\RegSvcs.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-aarsvc_31bf3856ad364e35_10.0.22000.1_none_b9334c2faa2133a2\agentactivationruntimestarter.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-edge-microsoftedgecp_31bf3856ad364e35_10.0.22000.1_none_1779dd0615e565ea\MicrosoftEdgeCP.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-bash_31bf3856ad364e35_10.0.22000.1_none_95defc35c15b2b6b\bash.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wusa_31bf3856ad364e35_10.0.22000.1_none_03442f231d65ee9c\wusa.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-x..jectdialog.appxmain_31bf3856ad364e35_10.0.22000.120_none_f698302c22284569\f\XGpuEjectDialog.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-dpapi-keys_31bf3856ad364e35_10.0.22000.1_none_de6b1af4069aa942\dpapimig.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..cesframework-ctfmon_31bf3856ad364e35_10.0.22000.1_none_fdc8d4cbc9bb5f92\ctfmon.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-os-kernel-la57_31bf3856ad364e35_10.0.22000.493_none_47936afef938817b\f\ntkrla57.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.22000.282_none_d037578ed2162e06\r\sdbinst.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\x86_netfx4-ngentask_exe_b03f5f7f11d50a3a_4.0.15806.0_none_1bb1d4f67da2d938\ngentask.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-d..ectxdatabaseupdater_31bf3856ad364e35_10.0.22000.282_none_30a5190270148358\directxdatabaseupdater.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-tetheringservice_31bf3856ad364e35_10.0.22000.41_none_6fef9dc502cda133\IcsEntitlementHost.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..frameworks-usermode_31bf3856ad364e35_10.0.22000.434_none_986ff8587a758e7c\WUDFCompanionHost.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lockapp.appxmain_31bf3856ad364e35_10.0.22000.348_none_e2c7a9ab59285812\LockApp.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-starttiledata_31bf3856ad364e35_10.0.22000.348_none_8c1cd5f65f938380\f\DataStoreCacheDumpTool.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.22000.348_none_5519d2fa88b436fc\SearchIndexer.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.22000.348_none_7c4c059b9e36fe85\r\SpatialAudioLicenseSrv.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-commandlinehelp_31bf3856ad364e35_10.0.22000.1_none_34c37d9c426177d3\help.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_caspol_b03f5f7f11d50a3a_10.0.22000.1_none_c0f347d59a01d496\CasPol.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appidcore_31bf3856ad364e35_10.0.22000.318_none_2a48e0773b83147e\r\appidtel.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..b-standardcollector_31bf3856ad364e35_10.0.22000.434_none_2ca09768f8a7e2e6\r\DiagnosticsHub.StandardCollector.Service.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-regini_31bf3856ad364e35_10.0.22000.1_none_6299da14be99f6ee\regini.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wrp-integrity-client_31bf3856ad364e35_10.0.22000.120_none_26a3fe1b7073b18d\sfc.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ac-sql-cliconfg-exe_31bf3856ad364e35_10.0.22000.1_none_d0b58ed08fdbb9ff\cliconfg.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_windows-defender-service_31bf3856ad364e35_10.0.22000.1_none_263e6ac68ff6695d\MpCmdRun.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-console-host-core_31bf3856ad364e35_10.0.22000.348_none_68edda92a96b8e44\r\conhost.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_10.0.22000.65_none_64161fe87cb55cea\f\pcaui.exe- 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-02_9f5cc34b32ff972f5cfb936ebf823774_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5208
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 4.8MB
- SHA256 c892e842eb654cacbd4429f50bc6183ccc74b50f27bb4a577f979afe930a5577
- MD5 37807c59e3b919b41dce4aa601d9a354
- SHA1 6bed772cf4a846fe382cea1050a6e8a3627a7c93
- SHA512 f43fc3e13d7d0f6efce61d2f0fc44d06d5374d52748b62f2d34d240fc7028c5532acc6e828b20a84027f70e6c740f48fbefdccfeb7168b77be4f5340b8bfd751
- SSDEEP 49152:kpPZuyWSG+BBvGvnjOyYVGlqRONszVBXdc/RJzVBXfqJtb2Ib+SVBXdcwPji0AjJ:khpBinjOykGcPdOR5fmd5joN
- TLSH T114369C16B2904277E0B39175C5AA5745EA7138791B31C3CB7388B26E2E337D2993B732
- MD5 SHA1 SHA512 SSDEEP TLSH