Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/07/2026, 10:29
Behavioral task
behavioral1
Sample
2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
- Size 10.7MB
- Sample260715-mjfjwadv21
- SHA256 6171391255cfdec541b8aceb74117e046990137e7c06f25eed3cc1e19b108661
- MD5 1dbe276dfb32c23bf74e7a50f301c0f5
- SHA1 586f8cc5053f1a102e623cdcc8cf4b17cb9c897a
- SHA512 4210d3b2303a91c3833863e75ed9ccfeffa56b06230ca81ac1f13f99cbd5e5c1de83eb98d0ef9b5eec71b6fba928e2b8dcf427f49d462e2e6e26e1235e4dbdea
- SSDEEP 98304:EhpBinjOykGcPdOR5NTIOSAkdvjozRL61joULapIpfkZcJ6L:cpAnjOyAdOrNTfgd7ozl6BoUcI1PJ6L
- TLSH T1B8B68E12B2E44237D0B6917ACAA25729D7B13C394BB1C3CB7244B6DD1E737C1A936722
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral2/files/0x001100000001b664-5.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral2/files/0x001100000001b664-5.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule behavioral2/files/0x001100000001b664-5.dat UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\userinit.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\AppVDllSurrogate.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ddodiag.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\netbtugc.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\prevhost.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\expand.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ktmutil.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\perfmon.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\poqexec.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\sethc.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\typeperf.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\unlodctr.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\unregmp2.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\bthudtask.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\chkdsk.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ctfmon.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ipconfig.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Netplwiz.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SecEdit.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\winrs.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\certutil.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cipher.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cliconfg.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\CloudNotifications.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\mspaint.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\regini.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\hh.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\msinfo32.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\shrpubw.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Taskmgr.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\winver.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\AtBroker.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\finger.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\rasphone.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\chcp.com 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\esentutl.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\fc.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\setx.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\shutdown.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\subst.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\taskkill.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wscript.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\appidtel.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\certutil.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\w32tm.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\WWAHost.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\autofstx.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cscript.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\driverquery.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\extrac32.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\TSTheme.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\hdwwiz.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\LaunchTM.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cmd.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\driverquery.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe -
resource yara_rule behavioral2/memory/3556-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/files/0x001100000001b664-5.dat upx behavioral2/memory/3556-407-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/3556-2915-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\dotnet\dotnet.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Defender\mpextms.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Media Player\wmpshare.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseImdsCollector.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseTVM.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Internet Explorer\iexplore.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-onecore-driververifier-tools_31bf3856ad364e35_10.0.26100.1150_none_5ce3f0df6c2eb9bb\verifier.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-i..sermode-kernel-la57_31bf3856ad364e35_10.0.26100.1742_none_8687939627e21dcf\securekernella57.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..rarydialog.appxmain_31bf3856ad364e35_10.0.26100.1150_none_69add7d861f392a8\AddSuggestedFoldersToLibraryDialog.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_10.0.26100.1150_none_1da178eaf53e7c4d\PrintBrm.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_netfx-dw_b03f5f7f11d50a3a_10.0.26100.1_none_2a2ee039ba45ffa6\dw20.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_10.0.26100.1591_none_28167f3f452aef57\r\pcaui.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..ative-serverbox-isv_31bf3856ad364e35_10.0.26100.1_none_fc5f223b9b5c3cc5\RMActivate_ssp_isv.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.26100.1591_none_720b9e48718f9c5a\r\spoolsvworker.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.26100.1591_none_29e868b2edff462b\r\AccountsControlHost.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-starttiledata_31bf3856ad364e35_10.0.26100.1591_none_2c8539fa8a63de14\r\DataStoreCacheDumpTool.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-storage-diagnostics_31bf3856ad364e35_10.0.26100.1591_none_10714fc4b84d2612\r\stordiag.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-trustedinstaller_31bf3856ad364e35_10.0.26100.1150_none_2cf483fafd109e7e\r\TrustedInstaller.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-utilman_31bf3856ad364e35_10.0.26100.1591_none_9e69ab15e1442616\Utilman.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.26100.1150_none_06d22316aa9884bc\r\vds.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-htmlhelp_31bf3856ad364e35_10.0.26100.1591_none_6415f1d934c35258\r\hh.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-mdmdiagnosticstool_31bf3856ad364e35_10.0.26100.1150_none_fae82cdc22c5f652\MdmDiagnosticsTool.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.26100.1591_none_97b3f064acd38654\SecureAssessmentBrowser.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasautodial_31bf3856ad364e35_10.0.26100.1150_none_abc14f2d153d07e6\rasautou.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vssservice_31bf3856ad364e35_10.0.26100.1_none_57c076d780640e4c\VSSVC.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-usercpl-usermgrbroker_31bf3856ad364e35_10.0.26100.1_none_1df4641271a5054b\UserAccountBroker.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\x86_netfx-aspnet_wp_exe_b03f5f7f11d50a3a_10.0.27000.313_none_a7d95898a02bb485\aspnet_wp.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_regsvcs_b03f5f7f11d50a3a_4.0.15912.0_none_47183375504a1255\RegSvcs.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-explorer_31bf3856ad364e35_10.0.26100.1591_none_f7c94c8b5e2407fe\r\explorer.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\csc.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-certificaterequesttool_31bf3856ad364e35_10.0.26100.1591_none_03d08eaac76f1ba8\certreq.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cipher_31bf3856ad364e35_10.0.26100.1150_none_48fdcfd155028bbe\r\cipher.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-magnify_31bf3856ad364e35_10.0.26100.1591_none_14427ce57d177902\r\Magnify.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-logagent_31bf3856ad364e35_10.0.26100.1_none_f288deea5ef6349f\logagent.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ping-utilities_31bf3856ad364e35_10.0.26100.1_none_b079f7ba2cc824d5\PATHPING.EXE- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SystemApps\Microsoft.Windows.FileExplorer_cw5n1h2txyewy\FileExplorer.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..onentpackagesupport_31bf3856ad364e35_10.0.26100.1150_none_fba3bb9888bf82a5\r\CompPkgSrv.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.26100.1591_none_bc36ad3cb5eb132d\r\wermgr.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-codeintegrity-citool_31bf3856ad364e35_10.0.26100.1301_none_aeea3d3f880e8dea\CiTool.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.26100.1150_none_25a595b3a76ab6cf\ImeBroker.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dpiscaling_31bf3856ad364e35_10.0.26100.1_none_773b7b96c37cb0e9\DpiScaling.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-forfiles_31bf3856ad364e35_10.0.26100.1150_none_f10ac0168d72b2cd\r\forfiles.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-security-tokenbroker_31bf3856ad364e35_10.0.26100.1591_none_49c71cad8f03abe2\TokenBrokerCookies.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wow64-legacy_31bf3856ad364e35_10.0.26100.1_none_f306a7a7706ba025\user.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-csvde_31bf3856ad364e35_10.0.26100.1150_none_f7257bce926ea30a\csvde.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-oobe-user-broker_31bf3856ad364e35_10.0.26100.1591_none_1fa6e4d8d638e827\UserOOBEBroker.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\Microsoft.ECApp.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-omadmclient_31bf3856ad364e35_10.0.26100.1591_none_ef5fd1803186a7fb\omadmclient.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.26100.1591_none_0bc717c8ecd0287d\WerFaultSecure.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_security-octagon-broker_31bf3856ad364e35_10.0.26100.1150_none_f5f28f643cc492d0\r\SgrmBroker.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\AppLaunch.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SystemApps\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\PeopleExperienceHost.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pnputil_31bf3856ad364e35_10.0.26100.1591_none_9923bdb86c8e5db2\pnputil.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ddodiag_31bf3856ad364e35_10.0.26100.1_none_3d9ee4c539dc092a\ddodiag.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..anagement-dmcfghost_31bf3856ad364e35_10.0.26100.1_none_2122cf9edbab3972\dmcfghost.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msdt_31bf3856ad364e35_10.0.26100.712_none_47a47970066d8602\r\msdt.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..sionagent-uachelper_31bf3856ad364e35_10.0.26100.1150_none_56a128e615a8ea59\r\RdpSaUacHelper.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..tnet-mua-hostserver_31bf3856ad364e35_10.0.26100.1150_none_6cd729c157564f7c\r\WinRTNetMUAHostServer.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-powershell-exe_31bf3856ad364e35_10.0.26100.1_none_6609a7146abf3e09\powershell.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_10.0.26100.1591_none_2c59a493cf48778f\r\msinfo32.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_457f9751bea691f1\replace.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..s-mdac-odbcconf-exe_31bf3856ad364e35_10.0.26100.1_none_0a6a82dd5aa9d087\odbcconf.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sethc_31bf3856ad364e35_10.0.26100.1591_none_fe803a2025222595\r\sethc.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dfsvc.exe 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..player-shellpreview_31bf3856ad364e35_10.0.26100.1150_none_5c8523a823214933\wmprph.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mobsyncexe_31bf3856ad364e35_10.0.26100.1150_none_8b382a05043f0680\mobsync.exe- 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-15_1dbe276dfb32c23bf74e7a50f301c0f5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3556
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 11.6MB
- SHA256 fc423387cd04196c30b6d98b7ddf43c2a1b7d91de70dff07cdba6bf6e027a62e
- MD5 e5d8ebad7d4c1b28b268014186e2314e
- SHA1 01be9d452b14cec77decfc81069e545797d5616c
- SHA512 de618ef7b38d268752cde848099a1b569e0aad177279d53fd71538de346dc55c97177d7f07f5971fa9149e363546f6e66abb860904436adb26cbd0bd69a177d7
- SSDEEP 98304:EhpBinjOykGcPdOR5NTIOSAkdvjozRL61joULapIpfkZcJ6wezSC6v2XMH/:cpAnjOyAdOrNTfgd7ozl6BoUcI1PJ6XU
- TLSH T110C68D12B2F44237D0B6D179CAA25729E7B13C694BB1C3CB7244B29D2E337D1A536722
- MD5 SHA1 SHA512 SSDEEP TLSH