Analysis
- max time kernel
150s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/07/2026, 19:05
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
- Size 10.0MB
- Sample260714-xrf6gset8v
- SHA256 92c4d7e1fb27b5de7d8ad94160de520b4e563aae88e642666001becd543696a3
- MD5 47ef623ad9f0301f388668dc62470544
- SHA1 d3ce07f1206d28ef7eeef9734649e3560c5bc7af
- SHA512 59440e39d7b0ba1b341c81df48eebb0fd6a7e9c3d5d8529aa9e2de53a873d5c06ec2289a1514390b48bf618cb61987ba09537a45e585aa4ae3426fea1fe630b3
- SSDEEP 98304:khpBinjOykGcPdOR5NTIOSAkdvjozRLFTIOSAHjo/:8pAnjOyAdOrNTfgd7ozlFTffo/
- TLSH T18EB69D1273E44637E0BA627EC0710A3997B1793E9B32C38F7544B95E5DA37828927723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral2/files/0x001000000001b85c-4.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral2/files/0x001000000001b85c-4.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule behavioral2/files/0x001000000001b85c-4.dat UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Robocopy.exe 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\sort.exe 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\LaunchTM.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\mcbuilder.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SecEdit.exe 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\svchost.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\TapiUnattend.exe 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\GamePanel.exe 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\upnpcont.exe 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wermgr.exe 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\explorer.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\raserver.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SecEdit.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cmdl32.exe 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\help.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\regedt32.exe 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SyncHost.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wusa.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\rasphone.exe 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\dxdiag.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\chkdsk.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\TapiUnattend.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\winrshost.exe 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\hh.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\icacls.exe 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\sxstrace.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\TRACERT.EXE 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wscript.exe 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cmstp.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\eudcedit.exe 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\net.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\PickerHost.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\getmac.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\iexpress.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\msra.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\xcopy.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\diskusage.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\dllhst3g.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\recover.exe 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\setupugc.exe 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\win32calc.exe 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\doskey.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\tree.com- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wusa.exe 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\schtasks.exe 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wsmprovhost.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\netiougc.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\OposHost.exe 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\PkgMgr.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\perfmon.exe 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\PickerHost.exe 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SndVol.exe 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\appidtel.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Mail\wab.exe 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseImdsCollector.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Windows Media Player\wmplayer.exe 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Media Player\wmplayer.exe 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Defender\MpCopyAccelerator.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-recover_31bf3856ad364e35_10.0.26100.1_none_8306f62f1d2799f7\recover.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.26100.1150_none_3a3e93ee89e96c57\phoneactivate.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\msil_addinutil_b77a5c561934e089_10.0.26100.1_none_b94f0eb8a758822f\AddInUtil.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deviceenroller_31bf3856ad364e35_10.0.26100.1591_none_5d054cd1bd51eff3\DeviceEnroller.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mystify_31bf3856ad364e35_10.0.26100.1150_none_8bf8eb890f472d80\r\Mystify.scr- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-scrnsave_31bf3856ad364e35_10.0.26100.1150_none_7d26f17a8a4ec06a\r\scrnsave.scr- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-omadmclient_31bf3856ad364e35_10.0.26100.1591_none_ef5fd1803186a7fb\omadmclient.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ktmutil_31bf3856ad364e35_10.0.26100.1150_none_24714894b112c0f3\r\ktmutil.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..essagingcoreservice_31bf3856ad364e35_10.0.26100.1_none_dffd701c50bad456\mqbkup.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1738_none_a5031b637767a4e7\containerworker.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-shellappruntime_31bf3856ad364e35_10.0.26100.1591_none_ae6cc2a1ab3ee224\r\ShellAppRuntime.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..tnet-mua-hostserver_31bf3856ad364e35_10.0.26100.1150_none_6cd729c157564f7c\r\WinRTNetMUAHostServer.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winlogon_31bf3856ad364e35_10.0.26100.1301_none_0b8f997b84f03748\winlogon.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_netfx4-ngen_exe_b03f5f7f11d50a3a_4.0.15912.100_none_aaf04994419917f0\ngen.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dataexchangehost_31bf3856ad364e35_10.0.26100.1301_none_8550d029188c257c\DataExchangeHost.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_userexperience-core_31bf3856ad364e35_10.0.26100.1591_none_53ec4fcd7ac99448\Core\LogonWebHostProduct.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\CBS\TextInputHost.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-appidcore_31bf3856ad364e35_10.0.26100.1591_none_d4e57f099acc84e0\appidtel.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.26100.1591_none_421e63a4855b894f\perfmon.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\vbc.exe 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.26100.1591_none_986ba09695018480\Microsoft.Uev.CscUnpinTool.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bits-bitsadmin_31bf3856ad364e35_10.0.26100.1150_none_e8f8e178bc55f481\bitsadmin.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-edge-microsoftedgecp_31bf3856ad364e35_10.0.26100.1150_none_5d1d8fd6c1063afd\MicrosoftEdgeCP.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pnputil_31bf3856ad364e35_10.0.26100.1591_none_9923bdb86c8e5db2\pnputil.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-xbox-gameoverlay_31bf3856ad364e35_10.0.26100.1150_none_da9d1a28d73a79cb\GamePanel.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_netfx35linq-addinprocess_31bf3856ad364e35_10.0.26100.1_none_2d8ad328b5479b73\AddInProcess.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_userexperience-core_31bf3856ad364e35_10.0.26100.1591_none_53ec4fcd7ac99448\Core\ScreenClippingHost.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\DesktopStickerEditorWin32Exe\DesktopStickerEditorWin32Exe.exe 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-netsh_31bf3856ad364e35_10.0.26100.1150_none_fb8846b4a7c2bad5\r\netsh.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..oreuap-iotuap-tools_31bf3856ad364e35_10.0.26100.1150_none_c74b9bded5451f89\r\iotstartup.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lipboardredirection_31bf3856ad364e35_10.0.26100.1591_none_9d960bc9bb2901f9\rdpclip.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1150_none_553b538bcf828876\r\WmiApSrv.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_userexperience-oobe_31bf3856ad364e35_10.0.26100.1591_none_54983d2d7a4908c4\OOBE\OobeHostApp.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.26100.1591_none_069d7eb507aa0068\r\SearchFilterHost.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.26100.1_none_686bcd839bc27ad8\typeperf.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.26100.1150_none_7c0a3bab447f4af9\ByteCodeGenerator.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_10.0.26100.1591_none_88f13a0c22218100\IMJPUEX.EXE- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dispdiag_31bf3856ad364e35_10.0.26100.1591_none_e0a4647be01e0453\dispdiag.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.26100.1591_none_c68b578eea4bd528\r\wermgr.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-xwizard-host-process_31bf3856ad364e35_10.0.26100.1_none_603c6385d5714700\xwizard.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.26100.1591_none_986ba09695018480\r\UevAgentPolicyGenerator.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-castserver_31bf3856ad364e35_10.0.26100.1_none_c492cc5e99915bfb\CastSrv.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1738_none_48e47fdfbf0a33b1\TiWorker.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\x86_netfx4-csc_exe_b03f5f7f11d50a3a_4.0.15912.338_none_b6935413ba17b58c\csc.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-proximityuxhost_31bf3856ad364e35_10.0.26100.1150_none_30e310bffc56cea9\r\ProximityUxHost.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ommand-line-utility_31bf3856ad364e35_10.0.26100.1_none_9e9d7dbf35638ca0\WMIC.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\x86_netfx35linq-linqwebconfig_31bf3856ad364e35_10.0.26100.1_none_f7e1c28598378da8\LinqWebConfig.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_comsvcconfig_b03f5f7f11d50a3a_4.0.15912.0_none_48717892bcec72f7\ComSvcConfig.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-e..taprotectioncleanup_31bf3856ad364e35_10.0.26100.1591_none_717110db66a82f37\r\EDPCleanup.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-edge-microsoftedgesh_31bf3856ad364e35_10.0.26100.1150_none_648c8216bc35a3e5\r\MicrosoftEdgeSH.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\x86_netfx4-vbc_exe_b03f5f7f11d50a3a_4.0.15912.355_none_d6930f2587043445\vbc.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_state.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-onlinesetup-component_31bf3856ad364e35_10.0.26100.1591_none_08d143c7d80566f8\oobeldr.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..-personalizationcsp_31bf3856ad364e35_10.0.26100.1591_none_dcb2480c8ab03707\r\desktopimgdownldr.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..native-whitebox-isv_31bf3856ad364e35_10.0.26100.1150_none_85392e759f939eae\RMActivate_isv.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-browser-brokers_31bf3856ad364e35_11.0.26100.1150_none_160ad4e2bcc0210f\r\browserexport.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-extcom_31bf3856ad364e35_10.0.26100.1591_none_a6992e1af01c7fb5\SppExtComObj.Exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..-deployment-package_31bf3856ad364e35_10.0.26100.1_none_5bc14811ec1c13bc\TFTP.EXE- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.26100.1150_none_8097a9dca8ee24c4\query.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-containerdiagnosticstool_31bf3856ad364e35_10.0.26100.1150_none_234860e0e753c908\hcsdiag.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filepicker.appxmain_31bf3856ad364e35_10.0.26100.1591_none_5e31b7c284234e98\r\FilePicker.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.26100.1301_none_22d8cfb46252dd83\WDAGNetDiag.exe- 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-14_47ef623ad9f0301f388668dc62470544_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3548
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 10.9MB
- SHA256 3231331a35faa76f3673658c2b8be63168bd222cb48c3bd291cca529ea55c95b
- MD5 7ebc8ef3361f0c25ffdc277a52c5609d
- SHA1 681f78ef67c792da699250344e9f23fd52403244
- SHA512 aeca725de5dcf8a5ab587e60e457fde701ac80f1aabcb888c44cc24a4a5a95e20d12bb0b42e30290f65ee09b9b2cb2e495657fde228298aae0f9a6a21c96a14f
- SSDEEP 98304:khpBinjOykGcPdOR5NTIOSAkdvjozRLFTIOSAHjo8ezSC6v2XMHW:8pAnjOyAdOrNTfgd7ozlFTffobR
- TLSH T169B67C1673E44237E0BA927EC0B11A29E771783A9B32C38F7544B95E5D637828937723
- MD5 SHA1 SHA512 SSDEEP TLSH