Analysis
- max time kernel
150s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/07/2026, 09:46
Behavioral task
behavioral1
Sample
2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
- Size 10.8MB
- Sample260715-lr5cjacv7s
- SHA256 e57fe66b24a54b4c7ef690880047225f656b9b6175527885f5a72c07a4c962b2
- MD5 8893ca1f38955b0646fd48a75c231bfa
- SHA1 443ba1c1909b3c004c1d4b21e5746a3e1b756543
- SHA512 73a7c1ef73c2417e9c1fb5b40a134c95f1e71761897ca2047ff7bcb7fddf9edb2dde79c4bb93f4d3817114ad459750bcfd60b5d720949c7e193dc36d0c15e750
- SSDEEP 98304:EhpBinjOykGcPdOR5NTIOSAkdvjozRL61joULapIpfkZc/jol:cpAnjOyAdOrNTfgd7ozl6BoUcI1PLol
- TLSH T196B68E12B2E40237D0B69179CAA25729D7B13C794BB1C3CB7244B6DD2E737C1A936722
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral2/files/0x00080000000113d4-5.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral2/files/0x00080000000113d4-5.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule behavioral2/files/0x00080000000113d4-5.dat UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\compact.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\proquota.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wextract.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\AppVDllSurrogate.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\doskey.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\help.exe 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\mavinject.exe 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\MuiUnattend.exe 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\OposHost.exe 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\rrinstaller.exe 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\sudo.exe 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\dxdiag.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\gpscript.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\gpupdate.exe 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\mfpmp.exe 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SyncHost.exe 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Dism.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\dllhost.exe 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\isoburn.exe 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\waitfor.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\edpnotify.exe 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\hh.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\regedt32.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\replace.exe 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\setupugc.exe 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\eventvwr.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\iscsicli.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\msra.exe 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\verclsid.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cmd.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\mtstocom.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\TCPSVCS.EXE- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\attrib.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\logagent.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\mmgaserver.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\resmon.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Fondue.exe 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\NETSTAT.EXE- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Taskmgr.exe 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Utilman.exe 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\autochk.exe 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\find.exe 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\msinfo32.exe 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\resmon.exe 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\unregmp2.exe 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\AtBroker.exe 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\PresentationHost.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\appidtel.exe 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cacls.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\GamePanel.exe 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\mode.com- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\srdelayed.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\systray.exe 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cscript.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\recover.exe 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\win32calc.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe -
resource yara_rule behavioral2/memory/3196-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/files/0x00080000000113d4-5.dat upx behavioral2/memory/3196-449-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/3196-2912-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Defender\mpextms.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\7-Zip\Uninstall.exe 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Internet Explorer\ieinstal.exe 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Media Player\wmplayer.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Internet Explorer\iexplore.exe 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Windows Mail\wab.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\7-Zip\7zFM.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseAP.exe 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Defender\mpextms.exe 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Defender\MsMpEng.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Media Player\wmlaunch.exe 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Media Player\wmpshare.exe 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ortingcompatibility_31bf3856ad364e35_10.0.26100.1591_none_9a5fa07ba58b88a8\r\DWWIN.EXE- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-clientcmdtools_31bf3856ad364e35_10.0.26100.1150_none_ed4ab399a05c1619\r\mount.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-notepad_31bf3856ad364e35_10.0.26100.1150_none_0b01ddf21fe9a3f6\notepad.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\OOBENetworkCaptivePortal.exe 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.26100.1_none_9609b71ef8d18dee\dfrgui.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-os-kernel_31bf3856ad364e35_10.0.26100.1742_none_07d5a4b5643ebc7c\ntoskrnl.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..structureexecutable_31bf3856ad364e35_10.0.26100.1591_none_93c87ba6060f19c7\lodctr.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1_none_065309a92fd714e9\poqexec.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printdialog.appxmain_31bf3856ad364e35_10.0.26100.1591_none_20d2a02f892fa68f\r\PrintDialog.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.26100.1_none_fcf0e4a9852b11e5\ssh-keyscan.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\CBS\MiniSearchHost.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\UUS\amd64\wuaucltcore.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-international-unattend_31bf3856ad364e35_10.0.26100.1591_none_5bd9bd7b9da089d6\r\MuiUnattend.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..rastructureconsumer_31bf3856ad364e35_10.0.26100.1591_none_4f9c89c5e078e421\r\plasrv.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_ce938c0efedcde06\NETSTAT.EXE- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-attrib_31bf3856ad364e35_10.0.26100.1_none_b9d66d642921dc90\attrib.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.26100.1455_none_b184dc3c337d380b\r\wmpconfig.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-web-app-host_31bf3856ad364e35_10.0.26100.1_none_39d8198a6bf822dd\WWAHost.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\x86_netfx-clr_ilasm_exe_b03f5f7f11d50a3a_10.0.26100.1_none_a74fce2d41576c14\ilasm.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.26100.1591_none_bd195c301c7f4e60\r\lpksetup.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_winappsdk-cbs_31bf3856ad364e35_10.0.26100.1591_none_60aad032a4073cbd\r\RestartAgent.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.26100.1591_none_594e71c0d6ce5e62\r\mavinject.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-control_31bf3856ad364e35_10.0.26100.1_none_a0b44bf0476b30ed\control.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-efs-rekeywiz_31bf3856ad364e35_10.0.26100.1_none_0f32fd2fa8c53bd5\rekeywiz.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-packagemanager_31bf3856ad364e35_10.0.26100.1591_none_92ec6994d7abdee6\r\PkgMgr.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-warp-jitexecutable_31bf3856ad364e35_10.0.26100.1150_none_69a15f49d214516d\r\Windows.WARP.JITService.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..commandlinetoolsmqq_31bf3856ad364e35_10.0.26100.1_none_261d19c21491b907\qwinsta.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bits-bitsadmin_31bf3856ad364e35_10.0.26100.1150_none_e8f8e178bc55f481\bitsadmin.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_curl_31bf3856ad364e35_10.0.26100.1301_none_248cf2c6018a558d\r\curl.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.26100.1591_none_161bc21b2130ea78\r\WerFaultSecure.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\x86_netfx-netfxsbs10_exe_31bf3856ad364e35_10.0.26100.1_none_dc63fc515e239427\NETFXSBS10.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\LogonWebHostProduct.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_addinutil_b77a5c561934e089_4.0.15912.0_none_feb4ea54186c4c66\AddInUtil.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.26100.1591_none_986ba09695018480\r\UevAgentPolicyGenerator.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-calc_31bf3856ad364e35_10.0.26100.1_none_a6b1a99b83489282\calc.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.26100.1591_none_2e9ff92c8dae3783\cmimageworker.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..pture-wmiv2provider_31bf3856ad364e35_10.0.26100.1591_none_8055c40aa3ab24a2\NetEvtFwdr.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_ce938c0efedcde06\r\ROUTE.EXE- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-edp-notify_31bf3856ad364e35_10.0.26100.1591_none_c6e1de18243de2ea\edpnotify.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audit-component_31bf3856ad364e35_10.0.26100.1_none_a3abe7a4df6b292a\AuditShD.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..tional-chinese-core_31bf3856ad364e35_10.0.26100.1591_none_f543f8b3b0fee44f\r\IMTCPROP.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.26100.1591_none_37c9b95250fac754\r\perfmon.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rundll32_31bf3856ad364e35_10.0.26100.1591_none_73c54cb65af16a28\rundll32.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..mpropertiesadvanced_31bf3856ad364e35_10.0.26100.1_none_f43c30384cd30669\SystemPropertiesAdvanced.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-smartscreen_31bf3856ad364e35_10.0.26100.1150_none_59491cddd00c2dba\r\smartscreen.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.26100.1742_none_227796ba348ec62b\r\MoUsoCoreWorker.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Workflow.Compiler.exe 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-lprportmonitor_31bf3856ad364e35_10.0.26100.1_none_b0f749e1a65b338a\lpq.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-scripting_31bf3856ad364e35_10.0.26100.1591_none_e4284e3cb060c8bf\r\wscript.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sensordataservice_31bf3856ad364e35_10.0.26100.1150_none_99eb378dda259f30\r\SensorDataService.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_netfx35cdf-csd_cdf_installer_31bf3856ad364e35_10.0.26100.1_none_554fc0a594820cda\WFServicesReg.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-resume_31bf3856ad364e35_10.0.26100.1742_none_091721c8d0a92082\r\winresume.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sstext3d_31bf3856ad364e35_10.0.26100.1_none_012c60dec828ce67\ssText3d.scr- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\x86_netfx-applaunch_exe_b03f5f7f11d50a3a_10.0.26100.1_none_697667281e7cce2c\AppLaunch.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SystemApps\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\XGpuEjectDialog.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SystemApps\ParentalControls_cw5n1h2txyewy\WpcUapApp.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-alg_31bf3856ad364e35_10.0.26100.1150_none_44d0a2970b0871bf\r\alg.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-compact_31bf3856ad364e35_10.0.26100.1_none_f6e8e32b1e1f23da\compact.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-commandline-dsdiag_31bf3856ad364e35_10.0.26100.1150_none_e81654ffadf307a4\dcdiag.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-verclsid_31bf3856ad364e35_10.0.26100.1_none_b8da79967c00e6a5\verclsid.exe- 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3196
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 11.7MB
- SHA256 7f236e9c7323354f7d0aab23685a44f8b18ded869bc2da360b1cb5f6d14399e6
- MD5 7b61afc118843a48183fa6490e779117
- SHA1 a1515bdda0229e2b30b060e97c9b98a36d2683b2
- SHA512 63f18e3531098c3ac440659dc660dd789ff8b276896c964858873d9e387b69dfa5b9e032b97859a97c0fa9b646d95c321b13e55eac5bb5a33c87a929f3545059
- SSDEEP 98304:EhpBinjOykGcPdOR5NTIOSAkdvjozRL61joULapIpfkZc/jo6ezSC6v2XMHR:cpAnjOyAdOrNTfgd7ozl6BoUcI1PLox2
- TLSH T127C68D12B2F44237D0B6D179CAA25729E7B13C694BB1C3CB7244B29D2E337D1A536722
- MD5 SHA1 SHA512 SSDEEP TLSH