Analysis
- max time kernel
150s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/07/2026, 11:16
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
- Size 7.9MB
- Sample260714-ndmaxady5x
- SHA256 90d2a6dd19c1a928ab9420dffdae4c772944a6088f5f9c3dc4d904fa2bede831
- MD5 4409117249c95dfe023d3feb044fd251
- SHA1 ba32fbdb4912246077c425cc468400fab33e8c8e
- SHA512 b93a35b4cf43418df1d34d97b5b678d0c031fc47c8060e5d35e6b6d05e019eaaadcd859646c487a3d24e8109aadfe7fa5a66c3219eeb836987ccb135f63c8dae
- SSDEEP 98304:khpBinjOykGcPdOR5NTIOSAkdvjozRLzfkZcD:8pAnjOyAdOrNTfgd7ozlLPD
- TLSH T1A7867C16B3E44237E0B6927AC0B55B69E671343A5B32C3CF7244B65E1E637C28937722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral2/files/0x000e00000001c4cc-4.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral2/files/0x000e00000001c4cc-4.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule behavioral2/files/0x000e00000001c4cc-4.dat UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\eventvwr.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ARP.EXE- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cmstp.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\TapiUnattend.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Windows.WARP.JITService.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\charmap.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\dvdplay.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\RdpSa.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\recover.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\curl.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\format.com- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\msra.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\RMActivate.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SndVol.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\efsui.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\isoburn.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\msra.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\netiougc.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\RMActivate_ssp_isv.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\sdbinst.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\attrib.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Dism.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\OposHost.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\tree.com 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\unregmp2.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\user.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wextract.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wsmprovhost.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\at.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ByteCodeGenerator.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\iscsicpl.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\sort.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\TSTheme.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\verclsid.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\diskpart.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\reg.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\appidtel.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\control.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\forfiles.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\icsunattend.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\label.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\rasdial.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Taskmgr.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\efsui.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\extrac32.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\mountvol.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\pcaui.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\PING.EXE- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\win32calc.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\eudcedit.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\gpupdate.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\mfpmp.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\MRINFO.EXE- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\sxstrace.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\compact.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\msdt.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Defender\MpCopyAccelerator.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Windows Media Player\wmplayer.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\Classification\SenseCE.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Defender\MpDefenderCoreService.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseNdr.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Media Player\setup_wm.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Media Player\wmpshare.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\7-Zip\7zFM.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Media Player\wmpnetwk.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\show_third_party_software_licenses.bat 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Mozilla Firefox\firefox.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseCM.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Mozilla Firefox\updater.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Defender\MpDlpCmd.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_datasvcutil_b77a5c561934e089_4.0.15912.0_none_5cfe50bb9b6405ea\DataSvcUtil.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..atibility-assistant_31bf3856ad364e35_10.0.26100.1591_none_cf86813ad32dd96e\r\pcalua.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..cymanagerbrokerhost_31bf3856ad364e35_10.0.26100.1150_none_1ab61fff20240053\r\EASPolicyManagerBrokerHost.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..andlinepropertytool_31bf3856ad364e35_10.0.26100.712_none_b7b410b79e222f1d\r\imjpuexc.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wab-app_31bf3856ad364e35_10.0.26100.1_none_49f1b033747ffae2\wabmig.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..al-chinese-moimeexe_31bf3856ad364e35_10.0.26100.1150_none_cd32a881f6fe4738\r\ChtIME.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.26100.1591_none_3bb2eaeeb6f37532\r\dtdump.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\vbc.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winlogon-tools_31bf3856ad364e35_10.0.26100.1_none_91672235f58871de\wlrmdr.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.26100.1591_none_594e71c0d6ce5e62\r\AppVDllSurrogate.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wow64-legacy_31bf3856ad364e35_10.0.26100.1_none_f306a7a7706ba025\user.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.26100.1591_none_68327241782dd35b\r\AppVShNotify.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-commandline-dsdiag_31bf3856ad364e35_10.0.26100.1150_none_e81654ffadf307a4\r\dcdiag.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-forfiles_31bf3856ad364e35_10.0.26100.1150_none_f10ac0168d72b2cd\forfiles.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-terminalservices-theme_31bf3856ad364e35_10.0.26100.1150_none_71cd60532ab93f47\TSTheme.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_multipoint-wmsmanager_31bf3856ad364e35_10.0.26100.1591_none_b7cec9dc382cb5f1\r\WmsManager.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wmi-core-providerhost_31bf3856ad364e35_10.0.26100.1_none_17ab113e28526647\WmiPrvSE.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dfsvc.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\Microsoft.ECApp.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\DeploymentAgent.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-uevservice_31bf3856ad364e35_10.0.26100.1591_none_19642579da3d47f4\AgentService.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_10.0.26100.1591_none_71da000f2a392039\IMCCPHR.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..-commandline-editor_31bf3856ad364e35_10.0.26100.1_none_2e87dc5d933c136a\reg.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1150_none_553b538bcf828876\r\WMIADAP.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_10.0.26100.1591_none_7c2eaa615e99e234\r\IMCCPHR.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\hh.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.26100.1591_none_479c61fda9b5207c\msinfo32.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tasklist_31bf3856ad364e35_10.0.26100.1_none_2536da91c2de3f14\tasklist.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ebviewhost.appxmain_31bf3856ad364e35_10.0.26100.1150_none_a661f954ca482f71\Win32WebViewHost.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\msil_dfsvc_b03f5f7f11d50a3a_10.0.26100.1_none_0a0ceefe3c8778a8\dfsvc.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_8465405a0441f0fb\chcp.com- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_dual_kdnic.inf_31bf3856ad364e35_10.0.26100.1150_none_0d22cb5713b04a04\kdnicctrl.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ative-serverbox-isv_31bf3856ad364e35_10.0.26100.1150_none_90fe1fffae58c8c8\r\RMActivate_ssp_isv.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_10.0.26100.1_none_6eba2dc7c1074207\aspnet_regiis.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_d8e83661333da001\ROUTE.EXE- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..sition-uicomponents_31bf3856ad364e35_10.0.26100.1_none_d63cd2082238f294\wiaacmgr.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_10.0.26100.1591_none_1dc1d4ed10ca2d5c\r\pcaui.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-omadmclient_31bf3856ad364e35_10.0.26100.1591_none_ef5fd1803186a7fb\omadmclient.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lua_31bf3856ad364e35_10.0.26100.1150_none_4231ada90cb553fb\consent.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.26100.1455_none_a73031e9ff1c7610\wmpshare.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_ce938c0efedcde06\ROUTE.EXE- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-waasmedic_31bf3856ad364e35_10.0.26100.1150_none_cf3b1bf5ee04490b\WaaSMedicAgent.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.26100.1591_none_e0a0e7a383989b03\IMEPADSV.EXE- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..structureexecutable_31bf3856ad364e35_10.0.26100.1591_none_9e1d25f83a6fdbc2\r\unlodctr.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Boot\DVD\PCAT\etfsboot.com- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-at_31bf3856ad364e35_10.0.26100.1150_none_e8e8f4e033ce6e38\r\at.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.26100.1150_none_25a595b3a76ab6cf\ImeBroker.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dataexchangehost_31bf3856ad364e35_10.0.26100.1301_none_8550d029188c257c\r\DataExchangeHost.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-os-kernel_31bf3856ad364e35_10.0.26100.1742_none_07d5a4b5643ebc7c\ntoskrnl.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_netfx4-vbc_exe_b03f5f7f11d50a3a_4.0.15912.0_none_98d146a6029264ee\vbc.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\x86_netfx-vb_compiler_b03f5f7f11d50a3a_10.0.26100.1_none_e42eb82359ca4cf7\vbc.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SystemApps\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\CHXSmartScreen.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\OOBENetworkCaptivePortal.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-computerdefaults_31bf3856ad364e35_10.0.26100.1150_none_a25df22273335338\ComputerDefaults.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-healthattestation-csp_31bf3856ad364e35_10.0.26100.1591_none_c6d9ee3b6b5cb11f\r\HealthAttestationClientAgent.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..devicescontrolpanel_31bf3856ad364e35_10.0.26100.1150_none_c0871c4af90b9611\r\ImagingDevices.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-provisioning-core_31bf3856ad364e35_10.0.26100.1591_none_538f0058df8c2519\provtool.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-srdelayed_31bf3856ad364e35_10.0.26100.1_none_5da5aa85f914f74d\srdelayed.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ie-iexpress_31bf3856ad364e35_11.0.26100.1_none_3942649659baf906\wextract.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dns-client_31bf3856ad364e35_10.0.26100.1_none_ded6253deae5fdf0\dnscacheugc.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-os-kernel_31bf3856ad364e35_10.0.26100.1742_none_07d5a4b5643ebc7c\r\ntoskrnl.exe- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ribbons_31bf3856ad364e35_10.0.26100.1150_none_249c3478d7e5d3ca\r\Ribbons.scr- 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-14_4409117249c95dfe023d3feb044fd251_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2400
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 8.8MB
- SHA256 1c9aaf922bb7e82036c56957e3545b6edb77fc4de475f5814c7ffd32578f638b
- MD5 308fbf1142dc00bbbb9876d2b3532443
- SHA1 1d53853c2179a40bc0ae325bd9e867d5640ff88c
- SHA512 b3193909bf21659338c020f222c6e5a6e2aadb731527d689285324b20fec28af22821bf465303d3599e7273c67592f17d325c91f4cbc527d01ed15fae83c3a63
- SSDEEP 98304:khpBinjOykGcPdOR5NTIOSAkdvjozRLzfkZc4ezSC6v2XMHo:8pAnjOyAdOrNTfgd7ozlLPvz
- TLSH T172967C16B2A44337E0B6917EC0B65B69EA71346A5B31C3CF3244B65D2E237D28937732
- MD5 SHA1 SHA512 SSDEEP TLSH