Analysis
- max time kernel
150s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/07/2026, 13:49
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe
- Size 16.1MB
- Sample260712-q4vfbac14x
- SHA256 4e33c32f444d7baa1c1f80a63f319de659b6e88c3787b0ae652e0b86e827f731
- MD5 2ebab10b2957aa9ce9f440bf1fac308a
- SHA1 4e8b688bf33141099790daa9f67bc49dc7c265ce
- SHA512 d93f87846c1e92b5aec8b3d9908a9d1696728be9487ea7f9cc1443172244d35883d1a20784da9289aff93ca7a13ec95432c4f3da6c23618e8a6ac1b95b8e9afc
- SSDEEP 196608:8pAnjOyAdOrfyKmd0jdccIA18UgorgTH2qBpu1QfLIqsufga:OAnBq6X7ETHNBpu1Qfc0D
- TLSH T169075B1272D54BA9C05FD034CE46566196633C594FB09BEF2680BEA93E326E07F3921F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule behavioral2/files/0x000f00000001b859-4.dat UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\rekeywiz.exe 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\resmon.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\ddodiag.exe 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\nslookup.exe 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\perfhost.exe 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\PkgMgr.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\SndVol.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\Windows.WARP.JITService.exe 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\compact.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\msfeedssync.exe 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\sudo.exe 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\wscadminui.exe 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\wscript.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\autofstx.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\grpconv.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\hh.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\icacls.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\logman.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\net1.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\srdelayed.exe 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\chkntfs.exe 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\cttune.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\expand.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\msiexec.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\PickerHost.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\TRACERT.EXE- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\openfiles.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\powercfg.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\SearchIndexer.exe 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\ARP.EXE- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\ieUnatt.exe 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\netsh.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\netsh.exe 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\efsui.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\poqexec.exe 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\sdbinst.exe 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\setx.exe 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\ktmutil.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\msra.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\reg.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\xcopy.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\xwizard.exe 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\chkntfs.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\Fondue.exe 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\ReAgentc.exe 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\cmdl32.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\diskpart.exe 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\edpnotify.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\find.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\findstr.exe 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\diskperf.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\wextract.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\show_third_party_software_licenses.bat 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\dotnet\dotnet.exe 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Internet Explorer\ieinstal.exe 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Windows Defender\DlpUserAgent.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseImdsCollector.exe 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Windows Defender\mpextms.exe 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Windows Media Player\wmprph.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Internet Explorer\ielowutil.exe 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-castserver_31bf3856ad364e35_10.0.26100.1_none_c492cc5e99915bfb\CastSrv.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..riseclientsync-host_31bf3856ad364e35_10.0.26100.1591_none_69d37612269b8f36\WorkFolders.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.26100.1150_none_fd0acb47aebf06db\logman.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sensors-runtimebroker_31bf3856ad364e35_10.0.26100.1591_none_4483428c4f7fb3a1\r\SensorRuntimeBroker.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_netfx4-ngen_exe_b03f5f7f11d50a3a_4.0.15912.100_none_aaf04994419917f0\ngen.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\msil_comsvcconfig_b03f5f7f11d50a3a_10.0.26100.1_none_8fc81fd68823646b\ComSvcConfig.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\splwow64.exe 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_windows-securityhealth-sso_31bf3856ad364e35_10.0.26100.1591_none_5b0badbc2600416b\SecurityHealthSystray.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..dstore-schema-shell_31bf3856ad364e35_10.0.26100.1150_none_2fc55246563e15a2\r\readCloudDataSettings.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.26100.1591_none_d64c3d514f37d908\r\IMEPADSV.EXE- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_10.0.26100.1150_none_49db19f88674c270\r\setup_wm.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..daryauthfactor-task_31bf3856ad364e35_10.0.26100.1150_none_67ed785bf55a7a21\r\DeviceCredentialDeployment.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..onwakesettingflyout_31bf3856ad364e35_10.0.26100.1150_none_48349abe916de6bd\r\PasswordOnWakeSettingFlyout.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..ommandline-dsdbutil_31bf3856ad364e35_10.0.26100.1_none_e06e3d007fa29525\dsdbutil.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-hgattest-catrustlet_31bf3856ad364e35_10.0.26100.1150_none_f9988b77e1b9cb1d\r\vmplatformca.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..oreuap-iotuap-tools_31bf3856ad364e35_10.0.26100.1150_none_c74b9bded5451f89\iotstartup.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wow64-legacy_31bf3856ad364e35_10.0.26100.1_none_f306a7a7706ba025\setup16.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-containerdiagnosticstool_31bf3856ad364e35_10.0.26100.1150_none_234860e0e753c908\r\hcsdiag.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-clip_31bf3856ad364e35_10.0.26100.1_none_a4cf8a7d848e0a15\clip.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cttunesvr_31bf3856ad364e35_10.0.26100.1150_none_8be227bace421d8d\cttunesvr.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\r\CBS\MiniSearchHost.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-fontview_31bf3856ad364e35_10.0.26100.1_none_4bac5ff253646284\fontview.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msaudittools_31bf3856ad364e35_10.0.26100.1_none_1ecd646959af4e74\auditpol.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-muicachebuilder_31bf3856ad364e35_10.0.26100.1_none_2154eeee51c5b168\mcbuilder.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SystemApps\LKG\MicrosoftWindows.LKG.Search_cw5n1h2txyewy\MiniSearchHost.exe 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-omadmclient_31bf3856ad364e35_10.0.26100.1591_none_ef5fd1803186a7fb\omadmclient.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..agespaces-spaceutil_31bf3856ad364e35_10.0.26100.1591_none_782468f07f32b467\r\spaceutil.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_windows-defender-service_31bf3856ad364e35_10.0.26100.1_none_c299cb2ebf592e77\MpDefenderCoreService.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_aspnet_regbrowsers_b03f5f7f11d50a3a_10.0.27000.360_none_a4b0965e18742ee0\aspnet_regbrowsers.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-legacyhwui_31bf3856ad364e35_10.0.26100.1150_none_7e5b72d9f82ad1d1\hdwwiz.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_10.0.26100.1591_none_8feeb08b8bdf7ddb\regedt32.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ative-serverbox-isv_31bf3856ad364e35_10.0.26100.1150_none_90fe1fffae58c8c8\r\RMActivate_ssp_isv.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-xbox-gameoverlay_31bf3856ad364e35_10.0.26100.1150_none_da9d1a28d73a79cb\r\GamePanel.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..auncher-cmdlinetool_31bf3856ad364e35_10.0.26100.1_none_f4339379cb9217a5\pwlauncher.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.26100.1150_none_664cc5d65cf1b4d8\wsmprovhost.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.26100.1591_none_069d7eb507aa0068\r\SearchProtocolHost.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-warp-jitexecutable_31bf3856ad364e35_10.0.26100.1_none_d5026185bf17c56a\Windows.WARP.JITService.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-certificateinstall_31bf3856ad364e35_10.0.26100.1591_none_d5752f789b3d8f3a\r\dmcertinst.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_10.0.26100.1150_none_1da178eaf53e7c4d\PrintBrmEngine.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pcwdiagnostic_31bf3856ad364e35_10.0.26100.1591_none_90ebc90aafaeeb97\pcwrun.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..m-service-migration_31bf3856ad364e35_10.0.26100.1742_none_32a8c94cc5f2eef2\ClipUp.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-hns-diagnosticstool_31bf3856ad364e35_10.0.26100.1591_none_41d04808d6b6d160\hnsdiag.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.26100.1150_none_85b50275334e6c75\uwfux.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_netfx-mscorsvw_exe_b03f5f7f11d50a3a_10.0.26100.1_none_7c88976e8785ad0a\mscorsvw.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_wpf-presentationhostexe_31bf3856ad364e35_10.0.26100.1150_none_0bdb83c7d007c6bc\PresentationHost.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-runonce_31bf3856ad364e35_10.0.26100.1591_none_bbcf7a15a36f8b3f\r\runonce.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\x86_netfx4-applaunch_exe_b03f5f7f11d50a3a_4.0.15912.0_none_f22ff467d1513409\AppLaunch.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.26100.1150_none_3a3e93ee89e96c57\LicensingUI.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.26100.1_none_a518656df7c165fb\MsSense.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..cesframework-ctfmon_31bf3856ad364e35_10.0.26100.1591_none_38f087fa4098616b\r\ctfmon.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..commandlinetoolsmqq_31bf3856ad364e35_10.0.26100.1_none_261d19c21491b907\msg.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..sition-uicomponents_31bf3856ad364e35_10.0.26100.1150_none_6adbcfcc35357e97\wiaacmgr.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-diskusage_31bf3856ad364e35_10.0.26100.1_none_b917a4fda287fde2\diskusage.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.26100.1_none_42b151b278e19c01\gpresult.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-magnify_31bf3856ad364e35_10.0.26100.1591_none_14427ce57d177902\r\Magnify.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deviceproperties_31bf3856ad364e35_10.0.26100.1_none_e73e0b63a2759f40\DeviceProperties.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_10.0.26100.1150_none_765afbb4c501d8c8\iscsicli.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ndkperf-setup_31bf3856ad364e35_10.0.26100.1150_none_862cccb1155d1695\NDKPerfCmd.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..services-sessionmsg_31bf3856ad364e35_10.0.26100.1150_none_d6b9ea087315f389\r\sessionmsg.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_d8e83661333da001\r\finger.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-assignedaccess-guard_31bf3856ad364e35_10.0.26100.1150_none_ce90aa676fe2a555\AssignedAccessGuard.exe- 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-12_2ebab10b2957aa9ce9f440bf1fac308a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1372
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 17.1MB
- SHA256 98f0842667da4b7b153850770510e6f2b07b502af0283836dfdc0217e388b44a
- MD5 b7ecfb5a8657f5bc7c37995929e0d0e0
- SHA1 4bc9f64972db9c24a1817ab8c2cde9ccbcdd7574
- SHA512 4c582653050b1094c312a403a3df3e7bcf15f35b469c72a241dab23454c3edc8a80e170f434c62e59d88c3ffca2a5f5aac62f860a84ac82b80f7e8a7317d67dd
- SSDEEP 196608:8pAnjOyAdOrfyKmd0jdccIA18UgorgTH2qBpu1QfLIqsufgYM:OAnBq6X7ETHNBpu1Qfc0k
- TLSH T1D6076B1271954BA9C05FD074CE466661AA633C454FB09BDF2680BEA93E326E07F3931F
- MD5 SHA1 SHA512 SSDEEP TLSH