Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/07/2026, 18:10
Behavioral task
behavioral1
Sample
2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe
- Size 4.2MB
- Sample260704-wr6kpse19m
- SHA256 23e15cca0b26aee219522720ff199e28d464056582afd7d82a394e136ef6d336
- MD5 8e6efcd5eb42785e94d2a7a26460809e
- SHA1 42017733088044ba943002d135deda6d300cbf05
- SHA512 74b8279b4deac8493bf7b6b06aac945e6f6636deff433d0dd9501c71cf23daf4efb70ce273fb4e84d1eb6aee3d956dcd6736f6bea2560e82321b26435889c546
- SSDEEP 49152:DvqPZRuifPji0AjmmIU6iCVwASO5GtlqodL51GMUs3d4qpcaPAmPaggHxv0L0qBs:DHiXjoE+d8MUSXIYa3Y4zt
- TLSH T1F9169D26F2A401E8D477C178C4965227E7B1BC160B718BCB16A4AABD1F33BE54E3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\cscript.exe 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\SysWOW64\format.com- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\SysWOW64\iexpress.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\SysWOW64\mountvol.exe 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\SysWOW64\PickerHost.exe 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\SysWOW64\tar.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\SysWOW64\attrib.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\SysWOW64\powercfg.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\SysWOW64\SearchIndexer.exe 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\SysWOW64\SystemUWPLauncher.exe 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\SysWOW64\wlanext.exe 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\SysWOW64\extrac32.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\SysWOW64\fltMC.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\SysWOW64\regini.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\SysWOW64\unlodctr.exe 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\SysWOW64\wusa.exe 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\SysWOW64\icacls.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\SysWOW64\dcomcnfg.exe 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\SysWOW64\RMActivate_ssp_isv.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\SysWOW64\verifiergui.exe 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\SysWOW64\ipconfig.exe 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\SysWOW64\Msdtc\Trace\msdtcvtr.bat 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\SysWOW64\msiexec.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\SysWOW64\chkntfs.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\SysWOW64\resmon.exe 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\SysWOW64\setup16.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\SysWOW64\svchost.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\SysWOW64\dvdplay.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\SysWOW64\find.exe 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\SysWOW64\Fondue.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\SysWOW64\typeperf.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\SysWOW64\cacls.exe 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\SysWOW64\dccw.exe 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\SysWOW64\scrnsave.scr 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\SysWOW64\sudo.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\SysWOW64\typeperf.exe 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\SysWOW64\wusa.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\SysWOW64\regedit.exe 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\SysWOW64\proquota.exe 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\SysWOW64\psr.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\SysWOW64\systeminfo.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\SysWOW64\cmdl32.exe 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\SysWOW64\gpscript.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\SysWOW64\MuiUnattend.exe 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\SysWOW64\ntprint.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\SysWOW64\ntprint.exe 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\SysWOW64\runas.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\SysWOW64\TSTheme.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\SysWOW64\dpnsvr.exe 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\SysWOW64\eudcedit.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\SysWOW64\tzutil.exe 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\SysWOW64\unregmp2.exe 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\SysWOW64\WWAHost.exe 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\SysWOW64\dpapimig.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe -
resource yara_rule behavioral2/memory/2412-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/files/0x00130000000113ec-5.dat upx behavioral2/memory/2412-957-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/2412-2912-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Program Files\Windows Defender\MpCopyAccelerator.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseImdsCollector.exe 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseTVM.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Program Files\Windows Media Player\wmplayer.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Program Files (x86)\Windows Media Player\wmprph.exe 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Program Files (x86)\Windows Media Player\wmplayer.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-lprportmonitor_31bf3856ad364e35_10.0.26100.1_none_b0f749e1a65b338a\lpq.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-driverquery_31bf3856ad364e35_10.0.26100.1_none_9d6b1e2831f6fc5c\driverquery.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ftp_31bf3856ad364e35_10.0.26100.1301_none_530ca0a73ce97b04\r\ftp.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-taskkill_31bf3856ad364e35_10.0.26100.1_none_2cc651b7f8fde87f\taskkill.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-browser-brokers_31bf3856ad364e35_11.0.26100.1150_none_160ad4e2bcc0210f\r\browser_broker.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-commandline_31bf3856ad364e35_10.0.26100.1150_none_cb65497b42fc406d\r\Dism.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-onlinesetup-component_31bf3856ad364e35_10.0.26100.1591_none_08d143c7d80566f8\r\oobeldr.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..atibility-assistant_31bf3856ad364e35_10.0.26100.1591_none_cf86813ad32dd96e\r\pcalua.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ping-utilities_31bf3856ad364e35_10.0.26100.1150_none_4518f57e3fc4b0d8\TRACERT.EXE- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1738_none_a5031b637767a4e7\containerworker.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.26100.1_none_42b151b278e19c01\gpupdate.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rundll32_31bf3856ad364e35_10.0.26100.1591_none_73c54cb65af16a28\r\rundll32.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..riencehost.appxmain_31bf3856ad364e35_10.0.26100.1301_none_970881ba6260e29a\StartMenuExperienceHost.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_aspnet_regsql_b03f5f7f11d50a3a_4.0.15912.355_none_cca5d427d5c6dc80\aspnet_regsql.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-devicepairingapp_31bf3856ad364e35_10.0.26100.1_none_76e6b4609ef9e4b1\DevicePairingWizard.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.26100.1742_none_4a8c1df49b9afb5a\Taskmgr.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nslookup_31bf3856ad364e35_10.0.26100.1150_none_6767c467165c7708\r\nslookup.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ommand-line-utility_31bf3856ad364e35_10.0.26100.1_none_9e9d7dbf35638ca0\WMIC.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-autoplay_31bf3856ad364e35_10.0.26100.1_none_22430350dce81c5d\wmlaunch.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cloudnotifications_31bf3856ad364e35_10.0.26100.1591_none_2dc797084143cfaf\r\CloudNotifications.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.26100.1591_none_2e9ff92c8dae3783\r\cmimageworker.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-omadmclient_31bf3856ad364e35_10.0.26100.1591_none_ef5fd1803186a7fb\r\omadmclient.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lishing-wmiprovider_31bf3856ad364e35_10.0.26100.1150_none_d11fa90f43730842\rdpsign.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_netfx-dfsvc_b03f5f7f11d50a3a_10.0.26100.1_none_6694132cb1b96a0b\dfsvc.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.26100.1591_none_7b25a93731217002\sdbinst.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-x..rtificateenrollment_31bf3856ad364e35_10.0.26100.1591_none_99ab5c6b730e7956\CertEnrollCtrl.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.26100.1591_none_986ba09695018480\r\Microsoft.Uev.CscUnpinTool.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..iondata-cmdlinetool_31bf3856ad364e35_10.0.26100.1150_none_24124d3c551588ce\bcdedit.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..tional-chinese-core_31bf3856ad364e35_10.0.26100.1591_none_ff98a305e55fa64a\IMTCPROP.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-compat-compattelrunner_31bf3856ad364e35_10.0.26100.1591_none_5ae89417c15099f2\r\CompatTelRunner.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-srdelayed_31bf3856ad364e35_10.0.26100.1_none_53510033c4b43552\srdelayed.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_windows.networking.vpn.nethost_31bf3856ad364e35_10.0.26100.1_none_ca6f6ae66cca19d0\NetHost.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_d8e83661333da001\ARP.EXE- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wusa_31bf3856ad364e35_10.0.26100.1_none_b448e42fb58a37ac\wusa.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-analog-facefodhandler_31bf3856ad364e35_10.0.26100.1591_none_461a2040b9fd2031\r\FaceFodUninstaller.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-commandprompt_31bf3856ad364e35_10.0.26100.1591_none_26ccc1e3ca6360b3\cmd.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ioningsecureprocess_31bf3856ad364e35_10.0.26100.1150_none_32bd5b6fcfab5b78\psp.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_10.0.26100.1150_none_51a2aa17b537a668\r\svchost.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-displayswitch_31bf3856ad364e35_10.0.26100.1150_none_88a9016fd4655cfd\r\DisplaySwitch.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-format_31bf3856ad364e35_10.0.26100.1_none_237c8b12f2862d5e\format.com- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_11.0.26100.1150_none_0f016472f35d0135\r\ieUnatt.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-previewhost_31bf3856ad364e35_10.0.26100.1150_none_df24b599b0c88e62\r\prevhost.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.26100.1150_none_8097a9dca8ee24c4\chglogon.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-o..onalfeatures-fondue_31bf3856ad364e35_10.0.26100.1_none_50fd5fe72912c2cf\Fondue.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-pickerhost_31bf3856ad364e35_10.0.26100.1591_none_53c210db32c306cd\r\PickerHost.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..llercommandlinetool_31bf3856ad364e35_10.0.26100.1_none_7bb68dcb719a0f10\sc.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-icm-ui_31bf3856ad364e35_10.0.26100.1591_none_d618b29150d63de2\colorcpl.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..pture-wmiv2provider_31bf3856ad364e35_10.0.26100.1591_none_8055c40aa3ab24a2\NetEvtFwdr.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ative-serverbox-isv_31bf3856ad364e35_10.0.26100.1150_none_90fe1fffae58c8c8\RMActivate_ssp_isv.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_netfx4-ngen_exe_b03f5f7f11d50a3a_4.0.15912.0_none_b4e0bc75d19eec35\ngen.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-robocopy_31bf3856ad364e35_10.0.26100.1591_none_6d1bd4f9d0cbd5f8\r\Robocopy.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-takeown_31bf3856ad364e35_10.0.26100.1_none_0133b87cb28b767b\takeown.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..anagement-dmomacpmo_31bf3856ad364e35_10.0.26100.1301_none_6b46da31a1bd9a38\DmOmaCpMo.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ortingcompatibility_31bf3856ad364e35_10.0.26100.1591_none_9a5fa07ba58b88a8\DWWIN.EXE- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..tiondialog.appxmain_31bf3856ad364e35_10.0.26100.1591_none_afc2e5d4c65ca426\r\PinningConfirmationDialog.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-safedocs-main_31bf3856ad364e35_10.0.26100.1591_none_c0c9b77316cf6b10\r\sdclt.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\WinSxS\x86_netfx-ngen_exe_b03f5f7f11d50a3a_10.0.26100.1_none_1bfc8ab3fe2cc7ba\ngen.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_multipoint-wmssvc_31bf3856ad364e35_10.0.26100.1591_none_5c83ef5441ff2734\r\WmsSvc.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_netfx4-csc_exe_b03f5f7f11d50a3a_4.0.15912.0_none_78ce8a6e35a89ad2\csc.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-xbox-gameoverlay_31bf3856ad364e35_10.0.26100.1_none_45fe1c64c43dedc8\GamePanel.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe- 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe - NSIS installer 1 IoCs
resource yara_rule behavioral2/files/0x00130000000113ec-5.dat nsis_installer_2
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-04_8e6efcd5eb42785e94d2a7a26460809e_amadey_cloudeye_cobalt-strike_coinminer_elex_glassworm_h.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2412
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 5.1MB
- SHA256 7fb782487724bf51d59766f5fad3cd0198f67cf664570a81f1bbea499e3f6b7f
- MD5 3abbbcb627edc5340b20a349ba2afad5
- SHA1 fd87dcb3aad7250ad9c5c4dc736e69c24339d9d7
- SHA512 932299119aa8ef78d2ffd8ce2dc7e08a3b03ec602017ec38a2e8b879d5eea496e344f2f6764230fafc7d5ffaac3e0b2738e025d8a03fb989c3699faaff66b17a
- SSDEEP 98304:DHiXjoE+d8MUSXIYa3Y4zSezSC6v2XMHJ:+ToEEU8IBtzZy
- TLSH T152468C26F6B842E5D077C078C5966627FA7278460B308BCB0255977D2F33BE58E3A721
- MD5 SHA1 SHA512 SSDEEP TLSH