Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
07/07/2026, 01:15
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
- Size 10.3MB
- Sample260707-bmeafae16w
- SHA256 269159eecd27b8975a8c14b1ebe4576ee3d89d877ee8216482b6cf04852d78bc
- MD5 bd661402f54bbead4e9dabd460a1dbb1
- SHA1 2eea5501b28872eca9f0d12c5624594b5810f243
- SHA512 97ff4b7a3ebdf513c7ac7125b2fdcb74efe34290daafc573f077e5cd0afcd5aae7e90c98d82657395a2fd8a06168d50b34988ab351180888999e2a7f0d162b8a
- SSDEEP 98304:khpBinjOykGcPdOR5NTIOSAkdvjozRL61joULapI969dG:8pAnjOyAdOrNTfgd7ozl6BoUcI969dG
- TLSH T158B67D12B2E00136D0B6917ACAA54725D7B13C7A4BF1C3DB7244B6D92E737C1BA36722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral1/files/0x00070000000231e6-4.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral1/files/0x00070000000231e6-4.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule behavioral1/files/0x00070000000231e6-4.dat UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\calc.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\dllhost.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\fsutil.exe 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\mfpmp.exe 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\regedt32.exe 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\timeout.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\tracerpt.exe 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\finger.exe 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\forfiles.exe 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\sfc.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cleanmgr.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\gpupdate.exe 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\label.exe 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\LaunchTM.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\secinit.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\sxstrace.exe 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cmdkey.exe 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Com\comrepl.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\eventvwr.exe 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\nslookup.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\provlaunch.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\whoami.exe 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\edpnotify.exe 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\netiougc.exe 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Utilman.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wevtutil.exe 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\choice.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\eventcreate.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\sc.exe 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\TRACERT.EXE- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\TSTheme.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ddodiag.exe 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\quickassist.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\chkntfs.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\eventcreate.exe 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\PkgMgr.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\efsui.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\fixmapi.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\fsutil.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\iexpress.exe 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\mstsc.exe 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\PickerHost.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\sort.exe 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cttune.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\PATHPING.EXE 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cliconfg.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\autoconv.exe 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wscript.exe 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\dvdplay.exe 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\hdwwiz.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\odbcconf.exe 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Media Player\wmplayer.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\show_third_party_software_licenses.bat- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\dotnet\dotnet.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows NT\Accessories\wordpad.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Internet Explorer\ExtExport.exe 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\show_third_party_software_licenses.bat 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Windows Media Player\wmplayer.exe 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Mail\wab.exe 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\wow64_microsoft-windows-wrp-integrity-client_31bf3856ad364e35_10.0.19041.1_none_eb848512bf047a3b\sfc.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.1202_none_23a707c9a0b5a8e1\f\LaunchTM.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..rvices-adam-install_31bf3856ad364e35_10.0.19041.1_none_d2c567b17279a950\adaminstall.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..structureexecutable_31bf3856ad364e35_10.0.19041.1_none_adf98e02f565c8fe\unlodctr.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ttings-removedevice_31bf3856ad364e35_10.0.19041.746_none_915a78ef54321214\r\SystemSettingsRemoveDevice.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-ngc-trustlet_31bf3856ad364e35_10.0.19041.423_none_c3eac275ecdf7e0a\r\NgcIso.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\jsc.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.1202_none_23a707c9a0b5a8e1\Taskmgr.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.19041.906_none_198d8d483aa30ed0\gpupdate.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.19041.1237_none_7578510aa0f564fa\f\vfpctrl.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-icm-ui_31bf3856ad364e35_10.0.19041.1_none_f049c4ee402ced19\colorcpl.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-xbox-gamecallableui.appxmain_31bf3856ad364e35_10.0.19041.746_none_0119299746221375\XBox.TCUI.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wmi-core-svc_31bf3856ad364e35_10.0.19041.1_none_60f873a5caaf6704\WinMgmt.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_addinprocess32_b77a5c561934e089_10.0.19041.1_none_3700bdc08c446a5c\AddInProcess32.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ortingcompatibility_31bf3856ad364e35_10.0.19041.1081_none_737d8b2eaaa38234\f\DWWIN.EXE- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ntalcontrolsmonitor_31bf3856ad364e35_10.0.19041.1266_none_bfb5312df2d5c960\f\WpcMon.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft.windows.winhttp_31bf3856ad364e35_5.1.19041.1151_none_d57e154a0a8460d3\r\pacjsworker.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_regsvcs_b03f5f7f11d50a3a_4.0.15805.0_none_4534bcdd53211170\RegSvcs.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..player-shellpreview_31bf3856ad364e35_10.0.19041.1266_none_3fb851095cc978d4\wmprph.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ndowmanager-process_31bf3856ad364e35_10.0.19041.746_none_11e04cec24452336\r\dwm.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lua_31bf3856ad364e35_10.0.19041.746_none_8443a7febb9ab03d\r\consent.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wslconfig_31bf3856ad364e35_10.0.19041.117_none_7f3778d7035d9622\f\wslconfig.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..oler-filterpipeline_31bf3856ad364e35_10.0.19041.264_none_098f3a6c3a48359d\r\printfilterpipelinesvc.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-bits-bitsadmin_31bf3856ad364e35_10.0.19041.1_none_0d5748d7e02a5474\bitsadmin.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.1081_none_38869341091832be\f\mofcomp.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cloudnotifications_31bf3856ad364e35_10.0.19041.746_none_7000e6adf00c3d30\f\CloudNotifications.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.19041.746_none_c7c6fccae233c8b7\f\uwfux.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eventlog-commandline_31bf3856ad364e35_10.0.19041.1202_none_3594628932065f23\r\wevtutil.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.19041.1237_none_a9b815907b71fe1a\wowreg32.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unp_31bf3856ad364e35_10.0.19041.264_none_8adc8bd8b75d383f\UNPUXHost.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\Temp\PendingDeletes\caae464736e5d7017ea100001815341f.InetMgr6.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tpm-tool_31bf3856ad364e35_10.0.19041.1202_none_7d4ea219d613c9d8\r\TpmTool.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-host-service_31bf3856ad364e35_10.0.19041.264_none_d58a0ca50a94510c\f\vmcompute.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..perience-ait-static_31bf3856ad364e35_10.0.19041.1202_none_a5a4c3f2637b55fa\r\aitstatic.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.19041.1237_none_7578510aa0f564fa\r\vfpctrl.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_ef0e010d1381269b\iisrstas.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mountvol_31bf3856ad364e35_10.0.19041.1_none_729f314325319478\mountvol.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..x-directxdiagnostic_31bf3856ad364e35_10.0.19041.1_none_d9b4a5b5fd217f4b\dxdiag.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lockapphost_31bf3856ad364e35_10.0.19041.746_none_d99fd60bc1fde773\f\LockAppHost.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-lsatrustlet_31bf3856ad364e35_10.0.19041.1288_none_5961108733e967c9\r\LsaIso.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..nputpersonalization_31bf3856ad364e35_10.0.19041.746_none_1da55dc225237a0d\r\InputPersonalization.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-com-surrogate-core_31bf3856ad364e35_10.0.19041.546_none_1d38815769c81e5a\dllhost.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-hns-diagnosticstool_31bf3856ad364e35_10.0.19041.423_none_841c30f68571c385\r\hnsdiag.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fax-service_31bf3856ad364e35_10.0.19041.804_none_8b46258bdefa0beb\r\FXSSVC.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lua_31bf3856ad364e35_10.0.19041.746_none_8443a7febb9ab03d\f\consent.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-snippingtool-app_31bf3856ad364e35_10.0.19041.746_none_77bd4cfbe87238a7\r\SnippingTool.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_networking-mpssvc-netsh_31bf3856ad364e35_10.0.19041.1151_none_23c0aa3b7bd960cd\f\CheckNetIsolation.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-runonce_31bf3856ad364e35_10.0.19041.1202_none_94cfabd8a89f0b96\f\runonce.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-newdev_31bf3856ad364e35_10.0.19041.1202_none_908b22903a403149\r\ndadmin.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-o..onalfeatures-fondue_31bf3856ad364e35_10.0.19041.1_none_09fac50a5fe3aec5\Fondue.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.1202_none_23a707c9a0b5a8e1\f\Taskmgr.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..-disposableclientvm_31bf3856ad364e35_10.0.19041.985_none_c3639a9e3ab1a351\r\WindowsSandboxClient.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..omerfeedbackmanager_31bf3856ad364e35_10.0.19041.1_none_9224c91b2d8eed57\imecfmui.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..switch-toasthandler_31bf3856ad364e35_10.0.19041.1_none_8089599dd595a93d\InputSwitchToastHandler.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ncsiuwpapp.appxmain_31bf3856ad364e35_10.0.19041.1052_none_648fbf276da33ed4\NcsiUwpApp.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-provisioning-core_31bf3856ad364e35_10.0.19041.153_none_95ba73d08e5f739c\provtool.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.19041.1_none_5106d54a804dbfc3\rmttpmvscmgrsvr.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..vercommandlinetools_31bf3856ad364e35_10.0.19041.1_none_70349c6644208282\flattemp.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\NarratorQuickStart.exe 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-containerdiagnosticstool_31bf3856ad364e35_10.0.19041.928_none_6571ff6e96271a64\hcsdiag.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_10.0.19041.1_none_a3224c6911783037\IMJPDCT.EXE- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-omadmclient_31bf3856ad364e35_10.0.19041.1_none_0990e3dd20dd5732\omadmclient.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-workspaceruntime_31bf3856ad364e35_10.0.19041.746_none_045e85893c117e35\f\wksprt.exe- 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3908
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 10.8MB
- SHA256 6ccc89a58ba4c27c5ce5d13de0646cdd44ef9568976d3c47df46acc30cad8003
- MD5 49c8b43e25c9ae0a130a716798989979
- SHA1 62228ce449d98c18f8973c1d9b4db923eaf6de69
- SHA512 872a44d9f9b526bf773214bfc9562a305793e73012298e66c57fc06ce5e46935fb700e414d792781a71eb3cef02d896281e7cfb7ddf3de89fda396587f7d2946
- SSDEEP 196608:8pAnjOyAdOrNTfgd7ozl6BoUcI969dcot:OAntRQ+hJnt
- TLSH T1EDB67D12B2E00236D0B6917ACAA25725D7B13C794BB1C3CB7244B6DD2E737D1A937722
- MD5 SHA1 SHA512 SSDEEP TLSH