Analysis
- max time kernel
148s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/07/2026, 23:02
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
- Size 11.9MB
- Sample260722-2z33fawerg
- SHA256 bd53ae922f5ac8df4fbafa319288737a1dcb83167167dd4efe98bb037af0531b
- MD5 f7e4c955b57acf3d42645ff32b96c450
- SHA1 396378a15c1a74cb3c2146e63e3516f68bda6d54
- SHA512 e3188af504e10f7f4331b8fdf046b28d0ca9417fbd60e8505d739bda32748c1a94367073f15ca1d75ad5c0912326704f531f7978dacab8e1badd0df2b05ba6d1
- SSDEEP 98304:khpBinjOykGcPdOR5NTIOSAljoj0oAaldmdmnpbjoUdMjokDpMdx:8pAnjOyAdOrNTfNogKmd0JoUdGok1Mdx
- TLSH T134C69E02B2A44276E077D179C5A14729D7713C6A4BB1C2CF3244B6DD2E737D2AA3B722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral2/files/0x000e00000001c582-4.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral2/files/0x000e00000001c582-4.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule behavioral2/files/0x000e00000001c582-4.dat UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\cliconfg.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\systeminfo.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cmdkey.exe 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\mshta.exe 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\raserver.exe 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\DWWIN.EXE 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\odbcconf.exe 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\TpmTool.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\verifiergui.exe 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wowreg32.exe 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\chcp.com- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\clip.exe 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\net.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\sdbinst.exe 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\tzutil.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\xcopy.exe 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\expand.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\timeout.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\AppVDllSurrogate.exe 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\calc.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ktmutil.exe 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\mtstocom.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\OposHost.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\regsvr32.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\resmon.exe 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\w32tm.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\RMActivate.exe 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\convert.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\doskey.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\msinfo32.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\runonce.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\winrm.cmd- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\perfmon.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\scrnsave.scr- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ttdinject.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Windows.WARP.JITService.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ByteCodeGenerator.exe 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\gpresult.exe 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\icacls.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\subst.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\esentutl.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\sethc.exe 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\winrs.exe 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wusa.exe 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\extrac32.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\extrac32.exe 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\prevhost.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\schtasks.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\psr.exe 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\sxstrace.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\verifiergui.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\findstr.exe 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\OposHost.exe 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\tar.exe 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\tcmsetup.exe 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wermgr.exe 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\show_third_party_software_licenses.bat- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Windows Media Player\wmlaunch.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Defender\MpCmdRun.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Windows Mail\wab.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Windows Mail\wabmig.exe 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Mozilla Firefox\firefox.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Media Player\wmpnetwk.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Defender\MpDlpCmd.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Defender\MpDlpService.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\Classification\SenseCE.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Media Player\wmprph.exe 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Windows Media Player\wmlaunch.exe 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Internet Explorer\ExtExport.exe 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Speech\Common\sapisvr.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SystemApps\Microsoft.Win32WebViewHost_cw5n1h2txyewy\Win32WebViewHost.exe 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_winappsdk-cbs_31bf3856ad364e35_10.0.26100.1591_none_60aad032a4073cbd\r\DeploymentAgent.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-r..-commandline-editor_31bf3856ad364e35_10.0.26100.1_none_38dc86afc79cd565\reg.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-browser-brokers_31bf3856ad364e35_11.0.26100.1150_none_160ad4e2bcc0210f\browser_broker.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.26100.1591_none_d64c3d514f37d908\r\IMEPADSV.EXE- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-notepad_31bf3856ad364e35_10.0.26100.1150_none_0b01ddf21fe9a3f6\r\notepad.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-oobe-machine_31bf3856ad364e35_10.0.26100.1591_none_a93e455bb3388085\r\msoobe.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-scripting_31bf3856ad364e35_10.0.26100.1591_none_e4284e3cb060c8bf\r\cscript.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sethc_31bf3856ad364e35_10.0.26100.1591_none_fe803a2025222595\r\sethc.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\msil_addinutil_b77a5c561934e089_10.0.26100.1_none_b94f0eb8a758822f\AddInUtil.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pktmon-setup_31bf3856ad364e35_10.0.26100.1591_none_efac539d4dc51fdd\PktMon.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\AppLaunch.exe 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_bsdtar_31bf3856ad364e35_10.0.26100.1150_none_f2155cb81beac176\tar.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.26100.1150_none_8097a9dca8ee24c4\query.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\x86_netfx4-applaunch_exe_b03f5f7f11d50a3a_4.0.15912.0_none_f22ff467d1513409\AppLaunch.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-commandlinehelp_31bf3856ad364e35_10.0.26100.1_none_d11ede0471c43ced\help.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lockapp.appxmain_31bf3856ad364e35_10.0.26100.1591_none_83300daf83f8b2a6\LockApp.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-clientcmdtools_31bf3856ad364e35_10.0.26100.1150_none_ed4ab399a05c1619\mount.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..-remoteapplications_31bf3856ad364e35_10.0.26100.1591_none_ddd035314c6868c8\r\rdpshell.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\x86_netfx-vb_compiler_b03f5f7f11d50a3a_10.0.26100.1_none_e42eb82359ca4cf7\vbc.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..roblemstepsrecorder_31bf3856ad364e35_10.0.26100.1591_none_76b18c52fb009a32\r\psr.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.26100.1591_none_d3181252b1eca58b\r\sdchange.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\x86_microsoft-windows-b..onment-dvd-etfsboot_31bf3856ad364e35_10.0.26100.1_none_2350f58e1a989738\etfsboot.com- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\LockApp.exe 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-driververifier-tools_31bf3856ad364e35_10.0.26100.1150_none_5ce3f0df6c2eb9bb\verifier.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..ment-bootsectortool_31bf3856ad364e35_10.0.26100.1150_none_a875b50b457475fd\r\bootsect.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-browser-brokers_31bf3856ad364e35_11.0.26100.1150_none_160ad4e2bcc0210f\browserexport.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ostic-user-resolver_31bf3856ad364e35_10.0.26100.1_none_c228ad766e3b968c\DFDWiz.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ktmutil_31bf3856ad364e35_10.0.26100.1150_none_24714894b112c0f3\ktmutil.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-expand_31bf3856ad364e35_10.0.26100.1_none_556624dcc06d0b8d\expand.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..oler-filterpipeline_31bf3856ad364e35_10.0.26100.1591_none_c76d94b08b6db4ab\printfilterpipelinesvc.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.26100.1591_none_d3181252b1eca58b\sdchange.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tieringengine_31bf3856ad364e35_10.0.26100.1150_none_4b5f1683145608dd\r\TieringEngineService.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-cipher_31bf3856ad364e35_10.0.26100.1_none_b45ed20d4205ffbb\cipher.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ping-utilities_31bf3856ad364e35_10.0.26100.1_none_b079f7ba2cc824d5\TRACERT.EXE- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bubbles_31bf3856ad364e35_10.0.26100.1_none_6b71ee9c327e3c02\Bubbles.scr- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-edge-microsoftedgecp_31bf3856ad364e35_10.0.26100.1150_none_5d1d8fd6c1063afd\r\MicrosoftEdgeCP.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..tional-chinese-core_31bf3856ad364e35_10.0.26100.1591_none_f543f8b3b0fee44f\r\IMTCPROP.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.26100.1150_none_acd0c33b64bc3fcf\r\iisrstas.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_10.0.26100.1150_none_1da178eaf53e7c4d\PrintBrm.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_userexperience-lkg_31bf3856ad364e35_10.0.26100.1742_none_3c72368675eae921\LKG.Search\SearchHost.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..nfiguration-cmdline_31bf3856ad364e35_10.0.26100.1_none_10a40aea1dac80e8\powercfg.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-win32calc_31bf3856ad364e35_10.0.26100.1_none_50f771e4b4a3c0ee\win32calc.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\RestartAgent.exe 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..omerfeedbackmanager_31bf3856ad364e35_10.0.26100.1591_none_77f3b6be3e383e20\imecfmui.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-com-complus-setup_31bf3856ad364e35_10.0.26100.1_none_f0f02bfb8c3b8acf\mtstocom.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\regedit.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-credwiz_31bf3856ad364e35_10.0.26100.712_none_41fcc82854bc2b0c\credwiz.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.26100.1150_none_d7504f768bde2804\gpupdate.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-browsercore_31bf3856ad364e35_10.0.26100.1150_none_f6b51f53ae693de3\BrowserCore.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1_none_aa346e257779a3b3\TiFileFetcher.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\MSBuild.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.26100.1150_none_1763b5dd5aadd1af\dpnsvr.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-ngc-trustlet_31bf3856ad364e35_10.0.26100.1591_none_819ed9883e248be5\r\NgcIso.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SystemApps\Microsoft.Windows.FilePicker_cw5n1h2txyewy\FilePicker.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-s..chservice-component_31bf3856ad364e35_10.0.26100.1591_none_495d0e173be5ed63\r\SpeechRuntime.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-service_31bf3856ad364e35_10.0.26100.1591_none_0065af33551e5c88\BdeUISrv.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1150_none_553b538bcf828876\WmiApSrv.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_aspnet_regsql_b03f5f7f11d50a3a_4.0.15912.355_none_cca5d427d5c6dc80\aspnet_regsql.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ieinstal_31bf3856ad364e35_11.0.26100.1150_none_c83b3d886b00dded\r\ieinstal.exe- 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-22_f7e4c955b57acf3d42645ff32b96c450_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4484
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 12.8MB
- SHA256 de46ee7cf29e40e69dcc1238e7803a75b6b7a604965416d84139641ad4c0b0c5
- MD5 de337469421b6f02c83ae61d45e83ef9
- SHA1 8ad0aa4c7f4e13fc50bf46ae2b09584f30bda717
- SHA512 f5d1d0dc2e9275b88e88cc2292e20796869bf9bda9ae3b07156b1211c2be3edb87ba758cbcd9d79d9d4ac6311f91a6681f7868f8776886e0ee80bdd2ea61c2d8
- SSDEEP 196608:8pAnjOyAdOrNTfNogKmd0JoUdGok1MdNQ:OAntqnqHQq
- TLSH T13CD69D12B2A44276D0B7C179C5A25629EB713C6A4B71C2CF3244B6DD2E337D1AA37732
- MD5 SHA1 SHA512 SSDEEP TLSH