Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/07/2026, 23:44
Behavioral task
behavioral1
Sample
2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe
- Size 16.3MB
- Sample260702-3rh8qsds6j
- SHA256 9e9f7b72b718214828600001221a9ba8f6cb84e5330af848b07d33aa819d7d89
- MD5 b29f99d602850e4b0f2ef1bdd00e24ed
- SHA1 eef41a96fa388c1c1d738711401da50a6a37015b
- SHA512 1cc5fe7c884f170db9294ae040b22ffb85a420ce6fc1e67d52a24fabf47b59e720f48d38830bfb75ded9a84c1d9e78112787f68bbb518a59da5a722e50747579
- SSDEEP 196608:WpAnjOynDdP66HtIto0AddvHOAoXvvOSdwHOAoXvvO2PsoG:sAn46YorOTCOT/G
- TLSH T173077B1D736621BDC2679078855ACA33FA3078044B319EBB2284D7792E77BA65D3B730
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule behavioral2/files/0x001000000001b8a5-5.dat UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\regedit.exe 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\ktmutil.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\prevhost.exe 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\relog.exe 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\sdbinst.exe 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\TCPSVCS.EXE- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\TpmInit.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\AppVDllSurrogate.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\forfiles.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\TSTheme.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\WerFault.exe 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\dllhst3g.exe 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\efsui.exe 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\gpscript.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\sdbinst.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\SndVol.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\sxstrace.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\w32tm.exe 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\grpconv.exe 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\newdev.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\PkgMgr.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\sdchange.exe 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\timeout.exe 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\finger.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\mspaint.exe 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\netbtugc.exe 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\ROUTE.EXE- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\cacls.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\dllhst3g.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\msdt.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\sdchange.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\sdiagnhost.exe 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\bitsadmin.exe 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\gpresult.exe 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\help.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\logman.exe 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\msfeedssync.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\Speech_OneCore\Common\SpeechModelDownload.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\unlodctr.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\cipher.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\eventvwr.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\user.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\where.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\eventcreate.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\finger.exe 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\format.com- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\ftp.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\ndadmin.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\RMActivate_ssp_isv.exe 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe -
resource yara_rule behavioral2/memory/3600-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/files/0x001000000001b8a5-5.dat upx behavioral2/memory/3600-323-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/3600-2909-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\7-Zip\Uninstall.exe 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseNdr.exe 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseCM.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseTVM.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Windows Defender\MpDlpService.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseCM.exe 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Windows Mail\wab.exe 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Windows Media Player\wmprph.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\WindowsBackupClient.exe 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-unifiedwritefilter_31bf3856ad364e35_10.0.26100.1591_none_37fa9a7337d181ee\r\UwfServicingSvc.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_userexperience-lkg_31bf3856ad364e35_10.0.26100.1742_none_3c72368675eae921\LKG.Search\MiniSearchHost.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_windows-application..egistrationverifier_31bf3856ad364e35_10.0.26100.1150_none_22d7b78874fa20b2\r\AppHostRegistrationVerifier.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.26100.1742_none_54e0c846cffbbd55\Taskmgr.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-clientcmdtools_31bf3856ad364e35_10.0.26100.1150_none_ed4ab399a05c1619\mount.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nslookup_31bf3856ad364e35_10.0.26100.1150_none_6767c467165c7708\nslookup.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-makecab_31bf3856ad364e35_10.0.26100.1_none_f817d499062c355e\makecab.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-d..s-vmswitch-netsetup_31bf3856ad364e35_10.0.26100.1742_none_200d0ee10b67fc30\r\nvspinfo.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sysprep_31bf3856ad364e35_10.0.26100.1150_none_8b65f13ba864c9e1\sysprep.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_ce938c0efedcde06\r\finger.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wusa_31bf3856ad364e35_10.0.26100.1_none_a9f439dd812975b1\wusa.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.26100.1_none_bf65878ace780f5e\shrpubw.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.26100.1591_none_10f229073c0ac263\r\SearchIndexer.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\WFServicesReg.exe 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..tnet-mua-hostserver_31bf3856ad364e35_10.0.26100.1150_none_6cd729c157564f7c\r\WinRTNetMUAHostServer.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.26100.1591_none_10f229073c0ac263\SearchIndexer.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ieinstal_31bf3856ad364e35_11.0.26100.1_none_bd6260d3acab64a7\ieinstal.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..plicationframe-host_31bf3856ad364e35_10.0.26100.1591_none_756d2e37dd0406ef\r\ApplicationFrameHost.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_netfx4-ngen_exe_b03f5f7f11d50a3a_4.0.15912.0_none_b4e0bc75d19eec35\ngen.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_d8e83661333da001\TCPSVCS.EXE- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_aspnet_regsql_b03f5f7f11d50a3a_10.0.26100.1_none_ac6c889a5b4138e1\aspnet_regsql.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..screencontentserver_31bf3856ad364e35_10.0.26100.1150_none_a32ebc355a703318\LockScreenContentServer.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-htmlhelp_31bf3856ad364e35_10.0.26100.1591_none_6415f1d934c35258\hh.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lockapp.appxmain_31bf3856ad364e35_10.0.26100.1591_none_83300daf83f8b2a6\r\LockApp.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..or-native-serverbox_31bf3856ad364e35_10.0.26100.1150_none_0ba6100513fbb80d\r\RMActivate_ssp.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_netfx35linq-csharp_31bf3856ad364e35_10.0.26100.1_none_141f576a7cb67351\csc.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\jsc.exe 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SystemApps\Microsoft.Win32WebViewHost_cw5n1h2txyewy\Win32WebViewHost.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-oobe-user-broker_31bf3856ad364e35_10.0.26100.1591_none_1fa6e4d8d638e827\UserOOBEBroker.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1150_none_553b538bcf828876\r\unsecapp.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..l-systemuwplauncher_31bf3856ad364e35_10.0.26100.1_none_0c53e49062af0dd7\SystemUWPLauncher.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..llshield-wow64-main_31bf3856ad364e35_10.0.26100.1_none_6b60acbaf3301f6c\setup.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..pertiescomputername_31bf3856ad364e35_10.0.26100.1_none_37bb8503d92b5a7e\SystemPropertiesComputerName.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-coredpussvr_31bf3856ad364e35_10.0.26100.1150_none_373500bc10348045\r\coredpussvr.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..temcompareutilities_31bf3856ad364e35_10.0.26100.1_none_fdba4ce39de8ec9f\comp.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..devicescontrolpanel_31bf3856ad364e35_10.0.26100.1150_none_c0871c4af90b9611\r\ImagingDevices.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-networkbridge_31bf3856ad364e35_10.0.26100.1455_none_a3b05fa5b61855a2\r\bridgeunattend.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.26100.1150_none_fd0acb47aebf06db\r\relog.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-systray_31bf3856ad364e35_10.0.26100.1_none_fa99cf8592f76fdd\systray.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bcdboot-cmdlinetool_31bf3856ad364e35_10.0.26100.1150_none_fd3d350bee0e4f11\r\bcdboot.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bits-bitsadmin_31bf3856ad364e35_10.0.26100.1150_none_e8f8e178bc55f481\r\bitsadmin.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-csp_31bf3856ad364e35_10.0.26100.1591_none_83cfa386bbdf1361\hvsievaluator.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-uus-core-ux_31bf3856ad364e35_10.0.26100.1591_none_8f2563a7ac59897b\r\MoNotificationUx.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mapi-mmga_31bf3856ad364e35_10.0.26100.712_none_82c18832efd3e8d9\r\mmgaserver.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-shutdown-event-tracker_31bf3856ad364e35_10.0.26100.1_none_0a1c6a6364e5546e\shutdown.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-assignedaccess-guard_31bf3856ad364e35_10.0.26100.1150_none_ce90aa676fe2a555\AssignedAccessGuard.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..-network-management_31bf3856ad364e35_10.0.26100.1591_none_6022424238410d39\r\nmbind.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1738_none_a5031b637767a4e7\TiWorker.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..sionagent-uachelper_31bf3856ad364e35_10.0.26100.1150_none_56a128e615a8ea59\RdpSaUacHelper.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.26100.1742_none_4a8c1df49b9afb5a\LaunchTM.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..rvices-adam-install_31bf3856ad364e35_10.0.26100.1150_none_b8bbaaa483060b58\r\adaminstall.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-setspn_31bf3856ad364e35_10.0.26100.1_none_7cf949ca46b06d03\setspn.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.26100.1150_none_8097a9dca8ee24c4\qappsrv.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-bits-bitsadmin_31bf3856ad364e35_10.0.26100.1_none_5459e3b4a959687e\bitsadmin.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-newdev_31bf3856ad364e35_10.0.26100.1_none_18be9e06ed967433\newdev.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..commandlinetoolsmqq_31bf3856ad364e35_10.0.26100.1_none_261d19c21491b907\msg.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unattendedjoin_31bf3856ad364e35_10.0.26100.1_none_b0088cffd56138b1\djoin.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-uus-core_31bf3856ad364e35_10.0.26100.1591_none_944de837a97599ab\r\MLEngineStub.exe- 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-02_b29f99d602850e4b0f2ef1bdd00e24ed_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3600
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 17.3MB
- SHA256 d038bbd7c6edb2bb2947f26d7d52fa4e0aaff854062b7e3ab097ab7f56245c5b
- MD5 492998c07f1dbfdbb35b5625033f8f0a
- SHA1 349907e1705d44df021002880f2ced453407d729
- SHA512 472275af358ca5e813033fc1a197f6e2c8e3d924f0e8a09c9e6eb40b4c6ac6702349161d85bf408e8aa829904677fb24b5b0fd18420ffc8f94b2bd967881df02
- SSDEEP 196608:WpAnjOynDdP66HtIto0AddvHOAoXvvOSdwHOAoXvvO2PsoUe:sAn46YorOTCOT/3
- TLSH T1DD077C1D736662BDC2679078859ADA33FA3074044B308EBB2284D7792E777E65D3A730
- MD5 SHA1 SHA512 SSDEEP TLSH