Analysis
- max time kernel
150s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/06/2026, 21:55
Behavioral task
behavioral1
Sample
2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe
- Size 11.8MB
- Sample260628-1swt4sfx6j
- SHA256 866beb6172adef990af6e28f987f399d3cd4341f6dbc5545b691abc8317c68d9
- MD5 6b280f93a965c0ab640ef9b6b942aa4b
- SHA1 d714701b2a907fba7896e55eb1e2e0de5625bdcf
- SHA512 5aace7a087e64f0a347a18fecce01b1c1c1b3581f2e6ad3c3d17f6602067e04d358390d336724847d2f2f9403594bb0a0d219e47dcda055fbe9e07e14e08d31f
- SSDEEP 196608:Wpdyn8OyJgV9z8bdsosEU8IBtz/WyZ/K0ttYVAIV9z8bdsos+:sdyndVosEU8IBJuyZ/K0ttYFVos+
- TLSH T10DC6AE23F29001F9D0A6C178CA569222EB71785907B197DF27949BA92F33AE07F3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule behavioral2/files/0x001e0000000118db-5.dat UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\esentutl.exe 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\MRINFO.EXE 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\shrpubw.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\user.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\appidtel.exe 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\dxdiag.exe 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\msfeedssync.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\sc.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\wevtutil.exe 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\choice.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\dialer.exe 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\notepad.exe 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\PING.EXE- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\autochk.exe 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\comp.exe 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\verclsid.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\chcp.com- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\sort.exe 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\systray.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\compact.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\doskey.exe 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\hdwwiz.exe 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\TapiUnattend.exe 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\SystemUWPLauncher.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\diskperf.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\extrac32.exe 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\Magnify.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\mstsc.exe 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\Taskmgr.exe 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\cscript.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\ctfmon.exe 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\cttunesvr.exe 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\mcbuilder.exe 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\runas.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\dfrgui.exe 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\findstr.exe 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\psr.exe 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\cmdkey.exe 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\dialer.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\fontview.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\pcaui.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\dfrgui.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\Dism.exe 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\dllhst3g.exe 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\msdt.exe 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\unlodctr.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe -
resource yara_rule behavioral2/memory/5156-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/files/0x001e0000000118db-5.dat upx behavioral2/memory/5156-512-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/5156-2909-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Windows Defender\MpDlpCmd.exe 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Windows Media Player\wmprph.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\uninstall.cmd- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\show_third_party_software_licenses.bat- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Mozilla Firefox\updater.exe 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\show_third_party_software_licenses.bat 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Internet Explorer\iexplore.exe 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Windows Defender\NisSrv.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Windows Defender\MpCmdRun.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.26100.1_none_b99a252d184bf301\ssh-add.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.26100.1591_none_196dbbee022bb530\SpeechModelDownload.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devicepairingapp_31bf3856ad364e35_10.0.26100.1150_none_0b85b224b1f670b4\DevicePairingWizard.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ttings-removedevice_31bf3856ad364e35_10.0.26100.1150_none_4f487e99a54cb5d2\SystemSettingsRemoveDevice.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-smss-minwin_31bf3856ad364e35_10.0.26100.1_none_7b547ea3515807e4\smss.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..agement-commandline_31bf3856ad364e35_10.0.26100.1_none_36c64bb72fffb46a\Dism.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SystemApps\Microsoft.Windows.PrintQueueActionCenter_cw5n1h2txyewy\PrintQueueActionCenter.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..ysafety-refreshtask_31bf3856ad364e35_10.0.26100.1591_none_fa6fdcd71655ec4d\WpcTok.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..spaces-spacemanager_31bf3856ad364e35_10.0.26100.1591_none_e5de07285a53f2d6\spaceman.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_10.0.26100.1000_none_e9c96c85d0fddddd\r\mstsc.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-charmap_31bf3856ad364e35_10.0.26100.1591_none_986e62d788c2c027\r\charmap.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.26100.1_none_d1adc81249f528d5\winrm.cmd- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cttunesvr_31bf3856ad364e35_10.0.26100.1150_none_8be227bace421d8d\cttunesvr.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..ne-plugins-wireless_31bf3856ad364e35_10.0.26100.1591_none_b99784523fc95a77\BypassNRO.cmd- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ountcontrolsettings_31bf3856ad364e35_10.0.26100.1591_none_1f650d1288a260be\UserAccountControlSettings.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet_wp_exe_b03f5f7f11d50a3a_10.0.27000.313_none_602c21c18baf8b7f\aspnet_wp.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\msil_addinprocess_b77a5c561934e089_10.0.26100.1_none_98735c9942cd7928\AddInProcess.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-audio-volumecontrol_31bf3856ad364e35_10.0.26100.1591_none_6c3d16dfebe198e3\r\SndVol.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cipher_31bf3856ad364e35_10.0.26100.1150_none_48fdcfd155028bbe\r\cipher.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-computerdefaults_31bf3856ad364e35_10.0.26100.1150_none_a25df22273335338\ComputerDefaults.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-webcamexperience_31bf3856ad364e35_10.0.26100.1150_none_08d020c05bb7ff70\CameraSettingsUIHost.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_winappsdk-cbs_31bf3856ad364e35_10.0.26100.1591_none_60aad032a4073cbd\DeploymentAgent.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.26100.1591_none_069d7eb507aa0068\r\SearchProtocolHost.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..m-service-migration_31bf3856ad364e35_10.0.26100.1742_none_32a8c94cc5f2eef2\ClipUp.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-unifiedwritefilter_31bf3856ad364e35_10.0.26100.1591_none_37fa9a7337d181ee\uwfservicingscr.scr- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-xwizard-host-process_31bf3856ad364e35_10.0.26100.1_none_603c6385d5714700\xwizard.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-u..ountcontrolsettings_31bf3856ad364e35_10.0.26100.1591_none_29b9b764bd0322b9\r\UserAccountControlSettings.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fsutil_31bf3856ad364e35_10.0.26100.1150_none_684b64ef9fd684b4\fsutil.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-secinit_31bf3856ad364e35_10.0.26100.1_none_84ab98d8358ad394\secinit.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_ce938c0efedcde06\r\MRINFO.EXE- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core-providerhost_31bf3856ad364e35_10.0.26100.1150_none_ac4a0f023b4ef24a\WmiPrvSE.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-netbt_31bf3856ad364e35_10.0.26100.1_none_67ad1b14943183e5\netbtugc.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.26100.1742_none_4a8c1df49b9afb5a\Taskmgr.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-filtermanager-utils_31bf3856ad364e35_10.0.26100.1_none_20d605b4c2450a61\fltMC.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.26100.1591_none_4aa2580f59a05075\r\wuaucltcore.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wusa_31bf3856ad364e35_10.0.26100.1_none_b448e42fb58a37ac\wusa.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-admincmdtools_31bf3856ad364e35_10.0.26100.1150_none_50956d2d42f20d39\r\nfsadmin.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ces-backgroundagent_31bf3856ad364e35_10.0.26100.1591_none_965659d18ab48b28\SpaceAgent.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\x86_regsvcs_b03f5f7f11d50a3a_4.0.15912.0_none_8ec56a4c64c63b5b\RegSvcs.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ktmutil_31bf3856ad364e35_10.0.26100.1150_none_24714894b112c0f3\r\ktmutil.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_netfx4-ilasm_exe_b03f5f7f11d50a3a_4.0.15912.0_none_61c655cc264adc4b\ilasm.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..switch-toasthandler_31bf3856ad364e35_10.0.26100.1591_none_70acf1931a9fbc01\r\InputSwitchToastHandler.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SystemApps\Microsoft.Windows.CapturePicker_cw5n1h2txyewy\CapturePicker.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\OOBENetworkConnectionFlow.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.26100.1742_none_fcf4914266c3a69d\CustomInstallExec.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..dstore-schema-shell_31bf3856ad364e35_10.0.26100.1150_none_2fc55246563e15a2\r\readCloudDataSettings.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ndation-frameserver_31bf3856ad364e35_10.0.26100.1591_none_5181bbfe74a17a20\r\FsIso.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-office-csp_31bf3856ad364e35_10.0.26100.1150_none_5952ab67e391cc12\ofdeploy.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wab-app_31bf3856ad364e35_10.0.26100.1_none_49f1b033747ffae2\wabmig.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Ldr64.exe 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\UUS\amd64\MoUsoCoreWorker.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-externaldictionary_31bf3856ad364e35_10.0.26100.1591_none_d85b84d668a60dd1\IMEWDBLD.EXE- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_netfx4-aspnet_regiis_exe_b03f5f7f11d50a3a_4.0.15912.355_none_7944a4ca9ef8c9af\aspnet_regiis.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_d8e83661333da001\MRINFO.EXE- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_windows-defender-service_31bf3856ad364e35_10.0.26100.1_none_ccee7580f3b9f072\MpCmdRun.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..esslockapp.appxmain_31bf3856ad364e35_10.0.26100.1150_none_d3d5c425d4ba6a5f\r\AssignedAccessLockApp.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-castserver_31bf3856ad364e35_10.0.26100.1_none_c492cc5e99915bfb\CastSrv.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..cymanagerbrokerhost_31bf3856ad364e35_10.0.26100.1150_none_1ab61fff20240053\r\EASPolicyManagerBrokerHost.exe- 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-28_6b280f93a965c0ab640ef9b6b942aa4b_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5156
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 12.7MB
- SHA256 8b7c88618a4f13a77fac66afc27d2ac850123fb803f5dd9d4d59b31fe3422f51
- MD5 ecad4d1eeee64c8e0f518e18add63f38
- SHA1 d77753954a302f109f1c6019d0dffacac7bbdb84
- SHA512 c0de9bad7f72e75726233bb971ac35053be8873e4c1305cdabf4c42d91a98290f01f99871500a24a08e43d708a99e5eafbc1c8d6662f87eff6b685cd8f02175a
- SSDEEP 196608:Wpdyn8OyJgV9z8bdsosEU8IBtz/WyZ/K0ttYVAIV9z8bdsosM4:sdyndVosEU8IBJuyZ/K0ttYFVosN
- TLSH T173D6AE13F2A402F5D0A7C178CA969222EB72745507B197DF239497A92F33AE07B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH