Analysis
- max time kernel
150s - max time network
112s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/07/2026, 16:04
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
- Size 7.6MB
- Sample260713-th2jaady8t
- SHA256 04fe65a2c9bcb63b11c235c8ea9227800990866d816948704f0b7f78b214ff9a
- MD5 4af9577f6dbc4156a2c5f4551f448d39
- SHA1 f267f1fa5626f3cb67ec16ec8b354a4473a3913e
- SHA512 4624a1afdfac28b28544954261e71d68c18987a9bf410d947f44cb0268738946006447c12ee5c70ae74a7f00ed487edf909a1cabfa88997168a12c9ce610cc95
- SSDEEP 98304:khpBinjOykGcPdOR5NTIOSAkdvjozRLHV:8pAnjOyAdOrNTfgd7ozlHV
- TLSH T165867B16B3E44237E0B6927EC0B51B29D671783A5B32C38F7244B55E5E637C2893B722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral2/files/0x00130000000118f0-4.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral2/files/0x00130000000118f0-4.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule behavioral2/files/0x00130000000118f0-4.dat UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\compact.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\makecab.exe 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\netbtugc.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\systray.exe 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wscadminui.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\GamePanel.exe 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\certutil.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\dxdiag.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\msfeedssync.exe 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Speech_OneCore\Common\SpeechModelDownload.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\svchost.exe 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\TpmTool.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wscript.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\proquota.exe 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\diskpart.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\System32\DriverStore\FileRepository\kdnic.inf_amd64_a9d04a55194853d2\kdnicctrl.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\eventcreate.exe 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\fltMC.exe 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ieUnatt.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\iscsicpl.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\gpupdate.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ieUnatt.exe 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\setup16.exe 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\stordiag.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\tree.com- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Utilman.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\bthudtask.exe 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\eventcreate.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\mcbuilder.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\setupugc.exe 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\TpmTool.exe 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\WWAHost.exe 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cmdkey.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cmstp.exe 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Taskmgr.exe 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\poqexec.exe 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\print.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\scrnsave.scr- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\chkdsk.exe 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\calc.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\LaunchTM.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\powercfg.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\regini.exe 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ROUTE.EXE 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\openfiles.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\timeout.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wextract.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\dcomcnfg.exe 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\dvdplay.exe 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\mmc.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\resmon.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\unregmp2.exe 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\7zFM.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\dotnet\dotnet.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Windows Media Player\wmpshare.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Internet Explorer\ExtExport.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{CDB16BBD-CB19-4D7F-84F7-16B278A1D844}\MicrosoftEdge_X64_139.0.3405.125.exe 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Defender\DlpUserAgent.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\show_third_party_software_licenses.bat- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Defender\NisSrv.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_curl_31bf3856ad364e35_10.0.26100.1301_none_1a384873cd299392\curl.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..screencontentserver_31bf3856ad364e35_10.0.26100.1150_none_a32ebc355a703318\LockScreenContentServer.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.26100.1150_none_fb078fe8106f7572\r\cmmon32.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-speech-userexperience_31bf3856ad364e35_10.0.26100.1591_none_b7c9eb31fbd37700\r\SpeechUXWiz.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-inputredirection_31bf3856ad364e35_10.0.26100.1591_none_9fe4b2d813f9a989\r\rdpinput.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\CBS\MiniSearchHost.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_windows-defender-service_31bf3856ad364e35_10.0.26100.1_none_c299cb2ebf592e77\MpDefenderCoreService.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-com-complus-ui_31bf3856ad364e35_10.0.26100.1_none_b7f01667e525edde\dcomcnfg.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SystemApps\Microsoft.Windows.FilePicker_cw5n1h2txyewy\FilePicker.exe 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-feedsbs_31bf3856ad364e35_11.0.26100.1150_none_dbed5373b4208431\msfeedssync.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-os-kernel-la57_31bf3856ad364e35_10.0.26100.1742_none_e81c261923f0a4b6\r\ntkrla57.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unp_31bf3856ad364e35_10.0.26100.1591_none_48bae61d0882b74d\r\UpdateNotificationMgr.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1000_none_5f95cc5803dfafcd\mofcomp.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\BrowserCore\BrowserCore.exe 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..raries-servercommon_31bf3856ad364e35_10.0.26100.1150_none_4572dc061ff88008\appcmd.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-openfiles_31bf3856ad364e35_10.0.26100.1150_none_830db7779a4e1286\r\openfiles.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pickerhost_31bf3856ad364e35_10.0.26100.1591_none_496d6688fe6244d2\PickerHost.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-user-choice-protection_31bf3856ad364e35_10.0.26100.1591_none_40b544c10dfa1d6f\r\UCPDMgr.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft.powershell.pester_31bf3856ad364e35_10.0.26100.1150_none_7019bb1b23bac3e2\Build.bat- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-commandprompt_31bf3856ad364e35_10.0.26100.1591_none_31216c35fec422ae\r\cmd.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-gdi_31bf3856ad364e35_10.0.26100.1591_none_4593139f0a8d3490\r\fontdrvhost.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nbtstat_31bf3856ad364e35_10.0.26100.1150_none_39f7d4e8ce48dadd\r\nbtstat.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_netfx4-servicemodelreg_exe_b03f5f7f11d50a3a_4.0.15912.0_none_cee89c9eae78ac91\ServiceModelReg.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.26100.1_none_66689223fd72e96f\cmdl32.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sensordataservice_31bf3856ad364e35_10.0.26100.1150_none_99eb378dda259f30\r\SensorDataService.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_caspol_b03f5f7f11d50a3a_4.0.15912.0_none_f28dd746997c1837\CasPol.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-registry-editor_31bf3856ad364e35_10.0.26100.1591_none_9a435addc0403fd6\regedt32.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\WsatConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-admincmdtools_31bf3856ad364e35_10.0.26100.1150_none_50956d2d42f20d39\nfsadmin.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systray_31bf3856ad364e35_10.0.26100.1_none_f04525335e96ade2\systray.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\r\CBS\TextInputHost.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasautodial_31bf3856ad364e35_10.0.26100.1_none_1722516902407be3\rasautou.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess.exe 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\DataSvcUtil.exe 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\Microsoft.ECApp.exe 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..tnet-mua-hostserver_31bf3856ad364e35_10.0.26100.1150_none_6cd729c157564f7c\WinRTNetMUAHostServer.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_windows-application..haringsvc-ntservice_31bf3856ad364e35_10.0.26100.1591_none_685b4f9deb1e8307\dstokenclean.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_windows-securityhealth-sso_31bf3856ad364e35_10.0.26100.1591_none_5b0badbc2600416b\r\SecurityHealthSystray.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.26100.1455_none_b184dc3c337d380b\wmpshare.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SystemApps\Microsoft.Windows.FilePicker_cw5n1h2txyewy\FilePicker.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.26100.1591_none_68327241782dd35b\r\AppVNice.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-xcopy_31bf3856ad364e35_10.0.26100.1_none_6a3dfd5b91399bfb\xcopy.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CasPol.exe 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\UUS\amd64\WaaSMedicAgent.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-edge-microsoftedgesh_31bf3856ad364e35_10.0.26100.1150_none_648c8216bc35a3e5\r\MicrosoftEdgeSH.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..msettings-datamodel_31bf3856ad364e35_10.0.26100.1591_none_85f1fbdaacd275e0\r\SystemSettingsBroker.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..commandlinetoolsmqq_31bf3856ad364e35_10.0.26100.1_none_261d19c21491b907\qwinsta.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_multipoint-wmssessionagent_31bf3856ad364e35_10.0.26100.1150_none_3d037cdb2138716c\r\WmsSessionAgent.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.26100.1591_none_db09ff29aaa57394\r\wowreg32.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\MSBuild.exe 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Speech\Common\sapisvr.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_10.0.26100.1150_none_49db19f88674c270\unregmp2.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..structureexecutable_31bf3856ad364e35_10.0.26100.1591_none_93c87ba6060f19c7\unlodctr.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..anagement-dmomacpmo_31bf3856ad364e35_10.0.26100.1301_none_6b46da31a1bd9a38\r\DmOmaCpMo.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_7a109607cfe12f00\print.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ie-impexp-extexport_31bf3856ad364e35_11.0.26100.1_none_02c44855de8e9d74\ExtExport.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-externaldictionary_31bf3856ad364e35_10.0.26100.1591_none_d85b84d668a60dd1\IMEWDBLD.EXE- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-es-authentication_31bf3856ad364e35_10.0.26100.1150_none_dda40d17c682c33c\EhStorAuthn.exe- 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-13_4af9577f6dbc4156a2c5f4551f448d39_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6792
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 8.5MB
- SHA256 99da3bdc0ba1d3a3b452b4740e21369e80275d1ad23d08ea21f9c8eb66aa2450
- MD5 9277d5ec628d7420891be0fe41210b49
- SHA1 fa29a3b5bd06d60892dfd97cc04d53fc95110242
- SHA512 877b111018ddc5d7487dcb4fe9d598799d30840921dcb3c4e0284b037208f9a32c6308c6d8951be36f9a564677293bb2c93559b85de149975f6bf34a9acb6216
- SSDEEP 98304:khpBinjOykGcPdOR5NTIOSAkdvjozRLHqezSC6v2XMHT:8pAnjOyAdOrNTfgd7ozlHB0
- TLSH T1F3968C12B3E44237E0B6917AC0B65B69E671342A5B31C3CF7244B65E2E637D28937732
- MD5 SHA1 SHA512 SSDEEP TLSH