Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
15/07/2026, 10:29
Behavioral task
behavioral1
Sample
2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
- Size 10.7MB
- Sample260715-mjfjwadv21
- SHA256 6171391255cfdec541b8aceb74117e046990137e7c06f25eed3cc1e19b108661
- MD5 1dbe276dfb32c23bf74e7a50f301c0f5
- SHA1 586f8cc5053f1a102e623cdcc8cf4b17cb9c897a
- SHA512 4210d3b2303a91c3833863e75ed9ccfeffa56b06230ca81ac1f13f99cbd5e5c1de83eb98d0ef9b5eec71b6fba928e2b8dcf427f49d462e2e6e26e1235e4dbdea
- SSDEEP 98304:EhpBinjOykGcPdOR5NTIOSAkdvjozRL61joULapIpfkZcJ6L:cpAnjOyAdOrNTfgd7ozl6BoUcI1PJ6L
- TLSH T1B8B68E12B2E44237D0B6917ACAA25729D7B13C394BB1C3CB7244B6DD1E737C1A936722
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral1/files/0x000f0000000231f3-5.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral1/files/0x000f0000000231f3-5.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule behavioral1/files/0x000f0000000231f3-5.dat UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\gpupdate.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\logagent.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\TapiUnattend.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\waitfor.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\winrm.cmd 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\dpnsvr.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\forfiles.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Magnify.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\mcbuilder.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\unlodctr.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ByteCodeGenerator.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cmdkey.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ROUTE.EXE 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\runonce.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\dcomcnfg.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\sc.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\chkdsk.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\tcmsetup.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\expand.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cttune.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\fixmapi.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\rasphone.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\esentutl.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\logman.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\setx.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\colorcpl.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cttunesvr.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\more.com 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\nslookup.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\sdiagnhost.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SystemUWPLauncher.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\appidtel.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\dtdump.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\fontdrvhost.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\net1.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\PATHPING.EXE- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Utilman.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\winrm.cmd- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\edpnotify.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\explorer.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ktmutil.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SecEdit.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\xcopy.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\tracerpt.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cttunesvr.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\NETSTAT.EXE 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\odbcad32.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\printui.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe -
resource yara_rule behavioral1/memory/2108-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/files/0x000f0000000231f3-5.dat upx behavioral1/memory/2108-592-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/2108-3212-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Mail\wab.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\show_third_party_software_licenses.bat- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Windows Mail\wabmig.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\uninstall.cmd 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\show_third_party_software_licenses.bat 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\ink\mip.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.19041.153_none_c8fbed52dad932cb\r\SysResetErr.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unattendedjoin_31bf3856ad364e35_10.0.19041.572_none_90e9bab3cbbfd71a\r\djoin.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.19041.964_none_9a882af90ea09cc3\f\ssh-keygen.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-certificateinstall_31bf3856ad364e35_10.0.19041.1151_none_ae854961a06058b2\r\dmcertinst.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\x86_netfx4-ngen_exe_b03f5f7f11d50a3a_4.0.15805.0_none_faaa7cb4e8f21456\ngen.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mapi_31bf3856ad364e35_10.0.19041.1_none_613e4ed2b91d35a0\fixmapi.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..randprintui-ntprint_31bf3856ad364e35_10.0.19041.1288_none_64cb20c6329bf2bd\f\ntprint.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..snotificationbroker_31bf3856ad364e35_10.0.19041.153_none_42505a6de732f7ca\f\MusNotification.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-grouppolicy-script_31bf3856ad364e35_10.0.19041.572_none_4d40b8e902f83dd6\gpscript.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-smss-minwin_31bf3856ad364e35_10.0.19041.964_none_5c42846f47acb1a6\f\smss.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ices-appcompattools_31bf3856ad364e35_10.0.19041.1_none_a9109d150b1bf064\ROOTDRV.CMD- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_addinprocess32_b77a5c561934e089_10.0.19041.1_none_3700bdc08c446a5c\AddInProcess32.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.1_none_171488549e32a4d3\tracerpt.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ping-utilities_31bf3856ad364e35_10.0.19041.1_none_5f22b28b2f384ed0\PATHPING.EXE- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..ommandline-dsdbutil_31bf3856ad364e35_10.0.19041.844_none_c171e0be75e709de\f\dsdbutil.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\MSBuild.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.19041.264_none_9627a04e40f9f001\SearchFilterHost.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-commandline-dsmgmt_31bf3856ad364e35_10.0.19041.1_none_00c77b5a9e4f1bee\dsmgmt.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-scrnsave_31bf3856ad364e35_10.0.19041.1_none_9730ae8779c25e62\scrnsave.scr- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-runonce_31bf3856ad364e35_10.0.19041.1_none_d6008c7292c63a76\runonce.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-containers-ccg_31bf3856ad364e35_10.0.19041.1_none_126d541494a0ae5b\CCG.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.19041.746_none_c7c6fccae233c8b7\f\uwfux.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-explorer_31bf3856ad364e35_10.0.19041.264_none_2f9647f4d89dc6f5\r\explorer.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft.windows.winhttp_31bf3856ad364e35_5.1.19041.264_none_7517ff6e147bc8a9\f\pacjsworker.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.19041.173_none_38fc88f8cb913df1\winload.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sxs_31bf3856ad364e35_10.0.19041.1_none_643da99ff70141b5\sxstrace.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-cleanmgr_31bf3856ad364e35_10.0.19041.1266_none_ec5eb439471de957\f\cleanmgr.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..randprintui-ntprint_31bf3856ad364e35_10.0.19041.1288_none_6f1fcb1866fcb4b8\ntprint.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasclienttools_31bf3856ad364e35_10.0.19041.1_none_2f8c879e7c6f8b16\rasphone.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-edp-notify_31bf3856ad364e35_10.0.19041.1202_none_958d6588f50ca146\f\edpnotify.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.19041.153_none_c8fbed52dad932cb\r\systemreset.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tabletpc-controlpanel_31bf3856ad364e35_10.0.19041.1_none_95647fabfa4ec9fe\tabcal.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..snotificationbroker_31bf3856ad364e35_10.0.19041.1266_none_d92abf553d8a282c\MusNotification.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-format_31bf3856ad364e35_10.0.19041.1_none_e6ce9a885db7db4f\format.com- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_networking-mpssvc-netsh_31bf3856ad364e35_10.0.19041.1151_none_2e15548db03a22c8\f\CheckNetIsolation.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\OOBENetworkCaptivePortal.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_10.0.19041.1266_none_22b99d078bbc3016\r\setup_wm.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_9aa166e99861c2bc\qprocess.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..usnotificationuxexe_31bf3856ad364e35_10.0.19041.153_none_51feabe070ab84f6\f\MusNotificationUx.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.19041.746_none_43128ab833fd583f\fsquirt.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.19041.1237_none_a9b815907b71fe1a\wowreg32.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.19041.964_none_9a882af90ea09cc3\ssh-keygen.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-winre-recoverytools_31bf3856ad364e35_10.0.19041.746_none_bd9bc99304595128\f\ReAgentc.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\AddInUtil.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ddodiag_31bf3856ad364e35_10.0.19041.1_none_f69c49e870acf520\ddodiag.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.264_none_4de8bd849baaa96f\WerFaultSecure.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fileexplorer.appxmain_31bf3856ad364e35_10.0.19041.546_none_476476bb5c3a0bbc\r\FileExplorer.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..nsimulation-service_31bf3856ad364e35_10.0.19041.746_none_b6b8620636970859\r\PerceptionSimulationService.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-smss-minwin_31bf3856ad364e35_10.0.19041.1_none_3451e3c68828f3da\smss.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-commandprompt_31bf3856ad364e35_10.0.19041.746_none_735abbdbad8c902f\f\cmd.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-uevservice_31bf3856ad364e35_10.0.19041.1288_none_f26bd0dcdf662cc9\f\AgentService.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..utermanagerlauncher_31bf3856ad364e35_10.0.19041.1_none_4406801793afabed\CompMgmtLauncher.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.19041.1_none_8c3cb0a560e64b91\splwow64.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-speech-userexperience_31bf3856ad364e35_10.0.19041.746_none_fa033ad7aa9be481\SpeechUXWiz.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sqm-consolidator-base_31bf3856ad364e35_10.0.19041.1081_none_491d51c316b5ea8f\f\wsqmcons.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.19041.964_none_dddeea757b7fbba7\ssh-keyscan.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-international-unattend_31bf3856ad364e35_10.0.19041.906_none_a892faef80a943dc\MuiUnattend.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_10.0.19041.746_none_56f2f7338735a9a6\f\WFS.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-browsercore_31bf3856ad364e35_10.0.19041.1151_none_cf9de3ecb3a8f61c\r\BrowserCore.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2108
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 11.2MB
- SHA256 3202b9c3a0e00c179eff3d0fe4cc2c174a0aefb76ac56c85eb7a38c5511b0c54
- MD5 2214f4bde99832274a3f759cedaf6989
- SHA1 47f94b6cdfaf1c333d9c89a3e5d94c849f98a44c
- SHA512 c1102c547131b57d5fc6d9b3b1919fcd89041b77475c3fa6d5cf88442ddd9c96da2c0a7ff6b6d9b0d84ec201b96a64fa25e8a744d7707979baf78c0d44bbbd4e
- SSDEEP 196608:cpAnjOyAdOrNTfgd7ozl6BoUcI1PJ6HoO:uAntRQ+h7IO
- TLSH T1FAC68E12B2E44237D0B79179CAA25729D7B13C694BB1C3CB7244B6DD2E337C1A936722
- MD5 SHA1 SHA512 SSDEEP TLSH