Analysis
- max time kernel
150s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/07/2026, 21:31
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe
- Size 14.3MB
- Sample260723-1c6dlsdc44
- SHA256 0f5fd980daa85ec7da06ded74edbc8d01bd6a5f6c580db9ea1743ee7fa0b612d
- MD5 8efd466076f9d63946928bccf24c5217
- SHA1 e80792600f53169e1e8e256689688871816acfa2
- SHA512 7f6465174c2c8be5f3691953ddb00f026f6fa230f1dc2332148d4635a7de370e5d96ebbe9e7f43ef792633ebb2344718a357b7cfaeb0bf7362f50d5c6748c6ea
- SSDEEP 196608:8pdyn8OyJgV9z8bdsosEU8IBtz/WyZ/K0ttYVAATm6qTfRo7:OdyndVosEU8IBJuyZ/K0ttYZThOW7
- TLSH T150E6AE13F2E401B5E0AAD27DC9714632D7717C2A4BB193CF2250B6E91E73BD16A39722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral2/files/0x000e000000019cd9-4.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Custom signatureDetects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral2/files/0x000e000000019cd9-4.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Custom signatureUPX dump on OEP (original entry point) 1 IoCs
resource yara_rule behavioral2/files/0x000e000000019cd9-4.dat UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\backgroundTaskHost.exe 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\ieUnatt.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\unregmp2.exe 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\wlanext.exe 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\Magnify.exe 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\typeperf.exe 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\Utilman.exe 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\mountvol.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\wscript.exe 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\cscript.exe 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\LaunchTM.exe 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\msinfo32.exe 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\perfhost.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\svchost.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\comp.exe 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\dtdump.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\recover.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\ndadmin.exe 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\WerFault.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\cmmon32.exe 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\icacls.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\mtstocom.exe 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\setup16.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\verifiergui.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\certutil.exe 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\cmdl32.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\compact.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\eventcreate.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\logagent.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\PING.EXE 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\cleanmgr.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\fontview.exe 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\reg.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\wsmprovhost.exe 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\grpconv.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\Netplwiz.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\newdev.exe 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\openfiles.exe 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\shrpubw.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\eudcedit.exe 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\dotnet\dotnet.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Internet Explorer\ieinstal.exe 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Windows Defender\MpDefenderCoreService.exe 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\uninstall.cmd 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Windows Media Player\setup_wm.exe 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseCM.exe 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Mozilla Firefox\updater.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Windows Defender\NisSrv.exe 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-surrogate_31bf3856ad364e35_10.0.26100.1150_none_e00b3f2ca36be9f9\dllhst3g.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-trustedinstaller_31bf3856ad364e35_10.0.26100.1150_none_2cf483fafd109e7e\r\TrustedInstaller.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SystemApps\NcsiUwpApp_8wekyb3d8bbwe\NcsiUwpApp.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lockapp.appxmain_31bf3856ad364e35_10.0.26100.1591_none_83300daf83f8b2a6\LockApp.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasclienttools_31bf3856ad364e35_10.0.26100.1_none_6c3a7829113ddd25\rasphone.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-customshellhost_31bf3856ad364e35_10.0.26100.1591_none_245703c14f08d5aa\r\CustomShellHost.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.26100.1455_none_b184dc3c337d380b\wmpconfig.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eventcreate_31bf3856ad364e35_10.0.26100.1150_none_714a211aef7dc47f\eventcreate.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-safedocs-main_31bf3856ad364e35_10.0.26100.1591_none_c0c9b77316cf6b10\sdclt.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.26100.1591_none_68327241782dd35b\AppVStreamingUX.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..switch-toasthandler_31bf3856ad364e35_10.0.26100.1591_none_66584740e63efa06\InputSwitchToastHandler.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.26100.1150_none_36fd183d90da21cb\tpmvscmgr.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_ce938c0efedcde06\MRINFO.EXE- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.26100.1_none_a518656df7c165fb\SenseIR.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-label_31bf3856ad364e35_10.0.26100.1_none_5e775e7a6735dc2c\label.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-net1-command-line-tool_31bf3856ad364e35_10.0.26100.1150_none_22c343e8047d12d1\r\net1.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-utilman_31bf3856ad364e35_10.0.26100.1591_none_9e69ab15e1442616\Utilman.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.26100.1_none_11a8c65c8f61d5fb\dpnsvr.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.26100.1591_none_986ba09695018480\r\UevTemplateConfigItemGenerator.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..ectionflow.appxmain_31bf3856ad364e35_10.0.26100.1150_none_c8dd030624b7f968\r\OOBENetworkConnectionFlow.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..spaces-spacemanager_31bf3856ad364e35_10.0.26100.1591_none_e5de07285a53f2d6\spaceman.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-cloudnotifications_31bf3856ad364e35_10.0.26100.1591_none_381c415a75a491aa\r\CloudNotifications.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mapi-mmga_31bf3856ad364e35_10.0.26100.712_none_82c18832efd3e8d9\r\mmgaserver.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regsql.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..eminputhost-process_31bf3856ad364e35_10.0.26100.1150_none_24aebd36aef95f82\ISM.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_windows-defender-offline-amcore_31bf3856ad364e35_10.0.26100.1150_none_e08d5281f8c7a395\r\OfflineScannerShell.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.26100.1742_none_4a8c1df49b9afb5a\r\LaunchTM.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-grouppolicy-script_31bf3856ad364e35_10.0.26100.1150_none_00fe88f91f962b70\r\gpscript.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-icm-dccw_31bf3856ad364e35_10.0.26100.1150_none_b6d5fc573e6d363a\dccw.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_netfx35linq-vb_compiler_orcas_31bf3856ad364e35_10.0.26100.1_none_92f5fcf757ed42ed\vbc.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_netfx4-csc_exe_b03f5f7f11d50a3a_4.0.15912.0_none_78ce8a6e35a89ad2\csc.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.26100.1591_none_4ef9c76ea26d9c67\r\mavinject.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.26100.1591_none_986ba09695018480\UevTemplateBaselineGenerator.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fontview_31bf3856ad364e35_10.0.26100.1150_none_e04b5db66660ee87\fontview.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.26100.1_none_a518656df7c165fb\MsSense.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\ScreenClippingHost.exe 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.26100.1742_none_cbf6967615a0f1cb\r\hvix64.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bits-bitsadmin_31bf3856ad364e35_10.0.26100.1150_none_e8f8e178bc55f481\r\bitsadmin.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_windows-defender-service_31bf3856ad364e35_10.0.26100.1_none_c299cb2ebf592e77\MpDlpCmd.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.26100.1150_none_d7504f768bde2804\r\gpresult.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-scripting_31bf3856ad364e35_10.0.26100.1591_none_e4284e3cb060c8bf\r\wscript.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_multipoint-wmsuseragent_31bf3856ad364e35_10.0.26100.1150_none_fcc2db11075b9319\WmsUserAgent.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_regsvcs_b03f5f7f11d50a3a_4.0.15912.0_none_47183375504a1255\RegSvcs.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-takeown_31bf3856ad364e35_10.0.26100.1_none_0133b87cb28b767b\takeown.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_windows-defender-service_31bf3856ad364e35_10.0.26100.1_none_ccee7580f3b9f072\MpCmdRun.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-admincmdtools_31bf3856ad364e35_10.0.26100.1150_none_50956d2d42f20d39\r\nfsadmin.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_10.0.26100.1591_none_8feeb08b8bdf7ddb\r\regedit.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..sor-native-whitebox_31bf3856ad364e35_10.0.26100.1150_none_3cdcbfd9e162066d\r\RMActivate.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\CBS\TextInputHost.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_wpf-presentationhostexe_31bf3856ad364e35_10.0.26100.1150_none_0bdb83c7d007c6bc\r\PresentationHost.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-optionaltsps_31bf3856ad364e35_10.0.26100.1_none_e94490f765d02436\tcmsetup.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-security-secedit_31bf3856ad364e35_10.0.26100.1_none_b62f80cd4eabea24\SecEdit.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\hh.exe 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-os-kernel-la57_31bf3856ad364e35_10.0.26100.1742_none_e81c261923f0a4b6\ntkrla57.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-scripting_31bf3856ad364e35_10.0.26100.1591_none_ee7cf88ee4c18aba\r\wscript.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_10.0.26100.1591_none_f3f0f30e057f293d\mstsc.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\x86_aspnet_compiler_b03f5f7f11d50a3a_10.0.26100.1_none_bd06c5e20c19d210\aspnet_compiler.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\EdmGen.exe- 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4296
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 15.2MB
- SHA256 780a2682e92602c05a4376690d83b8ede07c0a2dbaa2b7ff517da44d9f729b22
- MD5 9445719a4573d94e096e11c47b242d79
- SHA1 f8a2b44790725cc0f2f0fc35be5ff8e249dad1ae
- SHA512 0dd1921e43a03bfa5c978c2033b41efdea0a59ac584b68ef7a19e67b2912752f533b86e45eec0c398e403e5e2f44b17729409e51159e7f30bf56516e842feb6e
- SSDEEP 196608:8pdyn8OyJgV9z8bdsosEU8IBtz/WyZ/K0ttYVAATm6qTfRonx:OdyndVosEU8IBJuyZ/K0ttYZThOWx
- TLSH T182F6AE13F2E402B6E0B6D179C5725636EB717C1A4B7183CF2244B6E81E73BD16A39722
- MD5 SHA1 SHA512 SSDEEP TLSH