Analysis
- max time kernel
149s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
14/07/2026, 11:16
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
- Size 7.9MB
- Sample260714-ndmaxady5x
- SHA256 90d2a6dd19c1a928ab9420dffdae4c772944a6088f5f9c3dc4d904fa2bede831
- MD5 4409117249c95dfe023d3feb044fd251
- SHA1 ba32fbdb4912246077c425cc468400fab33e8c8e
- SHA512 b93a35b4cf43418df1d34d97b5b678d0c031fc47c8060e5d35e6b6d05e019eaaadcd859646c487a3d24e8109aadfe7fa5a66c3219eeb836987ccb135f63c8dae
- SSDEEP 98304:khpBinjOykGcPdOR5NTIOSAkdvjozRLzfkZcD:8pAnjOyAdOrNTfgd7ozlLPD
- TLSH T1A7867C16B3E44237E0B6927AC0B55B69E671343A5B32C3CF7244B65E1E637C28937722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral1/files/0x000c00000002428e-4.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral1/files/0x000c00000002428e-4.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule behavioral1/files/0x000c00000002428e-4.dat UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Com\comrepl.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\WerFault.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\comp.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\tar.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\esentutl.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\getmac.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\netiougc.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\OposHost.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\secinit.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\iexpress.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\scrnsave.scr 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\tzutil.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\appidtel.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\autofmt.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\dpapimig.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\net1.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\sort.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wecutil.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cmdkey.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\fltMC.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\lodctr.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\rekeywiz.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Fondue.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\makecab.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\regini.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\resmon.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\winver.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wscript.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\autofmt.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\PATHPING.EXE- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\rasphone.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ReAgentc.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\rekeywiz.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\shutdown.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\tcmsetup.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\powercfg.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\PresentationHost.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\charmap.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\CheckNetIsolation.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cttunesvr.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\icacls.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\relog.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\findstr.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wsmprovhost.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\control.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Msdtc\Trace\msdtcvtr.bat- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Windows.WARP.JITService.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\autoconv.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\explorer.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\fc.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\hh.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\netsh.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\perfhost.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\rasdial.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\grpconv.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\7-Zip\7z.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Internet Explorer\iexplore.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Internet Explorer\ExtExport.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-safedocs-main_31bf3856ad364e35_10.0.19041.264_none_02eb5d2ec5a9ec02\r\sdclt.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskapilibrary_31bf3856ad364e35_10.0.19041.1266_none_622873cfbda33994\r\convertvhd.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.19041.1110_none_b678ec2deb73b201\r\msra.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-xbox-gameoverlay_31bf3856ad364e35_10.0.19041.746_none_2703bed0ba809808\GamePanel.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-console-host-core_31bf3856ad364e35_10.0.19041.153_none_4b81b20e830f375b\r\conhost.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-recdisc-main_31bf3856ad364e35_10.0.19041.84_none_7c1f17a9e1beaf63\r\recdisc.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-klist_31bf3856ad364e35_10.0.19041.1266_none_b5fa73367bbd2f91\klist.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-shell-previewhost_31bf3856ad364e35_10.0.19041.746_none_2b8b5a41940eac9f\r\prevhost.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.19041.264_none_5481650943811810\SpatialAudioLicenseSrv.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..ysafety-refreshtask_31bf3856ad364e35_10.0.19041.153_none_3c9b504ec5293ad0\f\WpcTok.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..-network-management_31bf3856ad364e35_10.0.19041.1_none_7a53549f2797bc70\nmbind.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasautodial_31bf3856ad364e35_10.0.19041.546_none_edd345b6c42269da\f\rasautou.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-mbr2gpt_31bf3856ad364e35_10.0.19041.1237_none_6b74aa3973213895\r\MBR2GPT.EXE- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winlogon-tools_31bf3856ad364e35_10.0.19041.746_none_726cc4a1ebcb1c1e\mpnotify.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-extrac32_31bf3856ad364e35_10.0.19041.1_none_9b6f5274d7a3ac24\extrac32.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-settingsynchost_31bf3856ad364e35_10.0.19041.1202_none_fef803c70cc0b37b\r\SettingSyncHost.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-commandprompt_31bf3856ad364e35_10.0.19041.1_none_40fdd440b9ba0fea\cmd.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_10.0.19041.1266_none_22b99d078bbc3016\r\setup_wm.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shutdown-event-tracker_31bf3856ad364e35_10.0.19041.1_none_b8c5253467557e69\shutdown.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.19041.1266_none_fb98272b39a47240\f\usocoreworker.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-host-service_31bf3856ad364e35_10.0.19041.264_none_d58a0ca50a94510c\r\vmcompute.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..or-native-serverbox_31bf3856ad364e35_10.0.19041.1_none_25afcd12036f5605\RMActivate_ssp.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.19041.1288_none_3f2d1be96237886e\r\wsmprovhost.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.19041.264_none_8bd2f5fc0c992e06\SearchProtocolHost.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.19041.1266_none_eb6597ac99d11603\f\SpatialAudioLicenseSrv.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_10.0.19041.1237_none_4b16fb7fab206eb1\printui.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-extcom_31bf3856ad364e35_10.0.19041.1202_none_7f995fddf54c000c\SppExtComObj.Exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.19041.1_none_3d62a57d3b12dcf1\tree.com- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regsql.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.19041.746_none_c7c6fccae233c8b7\f\uwfux.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cttunesvr_31bf3856ad364e35_10.0.19041.1_none_a5ebe4c7bdb5bb85\cttunesvr.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..eldebugger-recorder_31bf3856ad364e35_10.0.19041.1_none_24a9c1e1e1b0f793\tttracer.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tapisetup_31bf3856ad364e35_10.0.19041.746_none_52411fe22e5a0ca1\TapiUnattend.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasclienttools_31bf3856ad364e35_10.0.19041.1266_none_e40ca34e5de298c9\rasphone.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-timeout_31bf3856ad364e35_10.0.19041.1_none_42557a4465a237c8\timeout.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.19041.1288_none_3f2d1be96237886e\WSManHTTPConfig.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_netfx-dfsvc_b03f5f7f11d50a3a_10.0.19041.1_none_833d086e8f306c45\dfsvc.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pcwdiagnostic_31bf3856ad364e35_10.0.19041.1_none_ab1cdb679f059ace\pcwrun.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securitycenter-core_31bf3856ad364e35_10.0.19041.1081_none_8f1e438c6737a711\f\wscadminui.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediafoundation_31bf3856ad364e35_10.0.19041.1266_none_1b79ad13f653c2a7\mfpmp.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rundll32_31bf3856ad364e35_10.0.19041.746_none_c05346ae3e1a99a4\f\rundll32.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-winre-recoverytools_31bf3856ad364e35_10.0.19041.746_none_bd9bc99304595128\r\ReAgentc.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..screencontentserver_31bf3856ad364e35_10.0.19041.1_none_bd38794249e3d110\LockScreenContentServer.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-more_31bf3856ad364e35_10.0.19041.1_none_624b5deeb86c35b8\more.com- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp_31bf3856ad364e35_10.0.19041.1266_none_8f272afdd624490f\f\sppsvc.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-net1-command-line-tool_31bf3856ad364e35_10.0.19041.844_none_64d33f8fb364398c\net1.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.19041.1266_none_5fd6523a3130632d\r\SysResetErr.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unp_31bf3856ad364e35_10.0.19041.1266_none_21c0be7c0dad3632\UpdateNotificationMgr.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.264_none_583d67d6d00b6b6a\r\WerFault.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..e-client-ui-wsreset_31bf3856ad364e35_10.0.19041.746_none_a47144c464d15475\r\WSReset.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-snippingtool-app_31bf3856ad364e35_10.0.19041.746_none_77bd4cfbe87238a7\SnippingTool.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.19041.1202_none_497a4c9b969ee5eb\wsmprovhost.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.19041.1266_none_ab5bdb26141e0be5\r\vmms.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filehistory-core_31bf3856ad364e35_10.0.19041.1110_none_29d8ec742bfd8b13\fhmanagew.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msconfig-exe_31bf3856ad364e35_10.0.19041.1110_none_4f46693352ed3250\f\msconfig.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..-management-console_31bf3856ad364e35_10.0.19041.746_none_f7c1402f08d2457a\r\mmc.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-powershell-exe_31bf3856ad364e35_10.0.19041.546_none_5163f0069562aff6\f\powershell.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-quickassist_31bf3856ad364e35_10.0.19041.1266_none_7d1b4a535854fe42\r\quickassist.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-u..etry-client-wowonly_31bf3856ad364e35_10.0.19041.1_none_4c7da197e5837576\dtdump.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wow64-legacy_31bf3856ad364e35_10.0.19041.1023_none_6aeab5d4bd0371a8\f\setup16.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4372
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 8.4MB
- SHA256 d5cfdf81dc9db3815b902d038dc93e90eba4b7a125817d71a50c02960ebcedcd
- MD5 1cb718001689341cbd4603f721d5d701
- SHA1 622493b1154d72cc8b7ba44a147fd1a049006553
- SHA512 825762afbc1c06e53451369378de885a1b5b58a078b6c305a4fb3ac1fdfcdc112a76ca9cfe17c966a3c5e787cd35ca1185420d81a606fe491ee1b88d81ef913f
- SSDEEP 98304:khpBinjOykGcPdOR5NTIOSAkdvjozRLzfkZc7jo1:8pAnjOyAdOrNTfgd7ozlLPvo1
- TLSH T14E968C16B3E44237E0B6917AC0B65B69E671342A5B32C3CF3244B65E1E637D28937732
- MD5 SHA1 SHA512 SSDEEP TLSH