Analysis
- max time kernel
149s - max time network
128s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/08/2026, 23:36
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
- Size 9.0MB
- Sample260802-3lqevsyxbv
- SHA256 fef88a98af36e09fa0c753c550c8db9b52187e8c89b25f33692f37bda21dc3a0
- MD5 d5be56d6e75d429a94c75f73b0ae0f9e
- SHA1 a43e556344ad4dcb45ca39a089d48e01068d8198
- SHA512 c33374ad8071e0c242b03325b560d59a4339056c7c0e9c42e1a59f334c0d06c5223f63a1e1f4ac4010b22857fc32cfc50b5470185694bf30915f6830e8154ac5
- SSDEEP 98304:khpBinjOykGcPdOR5NTIOSAkdvjozRLL6kLapIO:8pAnjOyAdOrNTfgd7ozlL6kcIO
- TLSH T15BA67C1272E00137E0AA917ACA65472597B13C7A8BF2C3DB7244B5DA1E737C17A36723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral1/files/0x000a000000024339-4.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral1/files/0x000a000000024339-4.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule behavioral1/files/0x000a000000024339-4.dat UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Dism\DismHost.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\fontdrvhost.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\label.exe 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\netiougc.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ROUTE.EXE- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\curl.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Netplwiz.exe 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\stordiag.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\sdiagnhost.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\printui.exe 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\RdpSa.exe 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\fontdrvhost.exe 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\TCPSVCS.EXE- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\waitfor.exe 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\calc.exe 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\userinit.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ntprint.exe 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\taskkill.exe 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\tttracer.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wlanext.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\fc.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ftp.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\mode.com 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\RmClient.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\upnpcont.exe 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\user.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\chkntfs.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\DpiScaling.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\expand.exe 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\mmc.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wlanext.exe 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cleanmgr.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\iscsicli.exe 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\mfpmp.exe 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\pcaui.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ReAgentc.exe 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\extrac32.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\iexpress.exe 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\PATHPING.EXE 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\quickassist.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\comp.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\gpresult.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wsmprovhost.exe 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\mountvol.exe 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\notepad.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\7zG.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Mail\wab.exe 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Windows Media Player\setup_wm.exe 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\dotnet\dotnet.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\dotnet\dotnet.exe 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Media Player\setup_wm.exe 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-d..rvices-adam-install_31bf3856ad364e35_10.0.19041.1_none_d2c567b17279a950\adamuninstall.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-usercpl-usermgrbroker_31bf3856ad364e35_10.0.19041.1_none_cc9d1ee374152f46\UserAccountBroker.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.19041.207_none_8d07de31084775c6\f\wuauclt.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.19041.1_none_f30cab80229c6b29\finger.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\r\AppVShNotify.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ng-server-isolation_31bf3856ad364e35_10.0.19041.746_none_7aa85dbabd7172c7\f\PrintIsolationHost.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pktmon-setup_31bf3856ad364e35_10.0.19041.928_none_31fd477afc7b8278\f\PktMon.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..cecontroller-minwin_31bf3856ad364e35_10.0.19041.928_none_1d29b4735b607954\r\services.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ttings-removedevice_31bf3856ad364e35_10.0.19041.1_none_69523ba694c053ca\SystemSettingsRemoveDevice.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-safedocs-main_31bf3856ad364e35_10.0.19041.746_none_03030718c597d891\f\sdclt.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_windows.networking.vpn.nethost_31bf3856ad364e35_10.0.19041.1_none_836cd009a39b05c6\NetHost.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deviceenroller_31bf3856ad364e35_10.0.19041.1202_none_36057e94c281704a\r\DeviceEnroller.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-efs-ui_31bf3856ad364e35_10.0.19041.1_none_ac65d58626f4027c\efsui.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-terminalservices-theme_31bf3856ad364e35_10.0.19041.746_none_b3df5aa8d99e9b89\f\TSTheme.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-thumbexthost_31bf3856ad364e35_10.0.19041.746_none_ce6643a69c39f80a\r\ThumbnailExtractionHost.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.19041.264_none_8bd2f5fc0c992e06\r\SearchIndexer.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-com-surrogate_31bf3856ad364e35_10.0.19041.1_none_0469a68bc74049ec\dllhst3g.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1288_none_71734bf99a2a6955\r\Microsoft.Uev.CscUnpinTool.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-magnify_31bf3856ad364e35_10.0.19041.1266_none_e2f3aaf24de135ec\f\Magnify.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.19041.1_none_805682e34c6552d0\wsmprovhost.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-autofmt_31bf3856ad364e35_10.0.19041.1_none_a639f4b392ec604e\autofmt.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..-management-console_31bf3856ad364e35_10.0.19041.1_none_cfb902e649608730\mmc.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_10.0.19041.1110_none_0565d41cd46ec20a\f\msinfo32.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-where_31bf3856ad364e35_10.0.19041.1_none_1e18f0f5b1e8db7d\where.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bootconfig_31bf3856ad364e35_10.0.19041.1_none_c2078a8db9a59aef\bootcfg.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-legacysnapin_31bf3856ad364e35_10.0.19041.1_none_3711e18b51638445\InetMgr6.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-recoverydrive_31bf3856ad364e35_10.0.19041.1237_none_9d556cf140e198b4\r\RecoveryDrive.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lishing-wmiprovider_31bf3856ad364e35_10.0.19041.1151_none_aa086da848b2c07b\rdpsign.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.1_none_6f451098bef6266e\unsecapp.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.423_none_72535ca9b59a9515\r\NarratorQuickStart.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lications-clientsku_31bf3856ad364e35_10.0.19041.1_none_d4cc2ddce5811964\rdpshell.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_a4f6113bccc284b7\query.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-icacls_31bf3856ad364e35_10.0.19041.1_none_f2fa56e679b879d1\icacls.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-c..periencehost-broker_31bf3856ad364e35_10.0.19041.746_none_1ce3c0f12fb5f8ec\CloudExperienceHostBroker.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appid_31bf3856ad364e35_10.0.19041.1202_none_cc0c3d35675da3a1\appidpolicyconverter.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-edge-microsoftedgesh_31bf3856ad364e35_10.0.19041.1_none_7e963f23aba941dd\MicrosoftEdgeSH.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ropertiesprotection_31bf3856ad364e35_10.0.19041.1_none_19a36451bbe13a1c\SystemPropertiesProtection.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.19041.964_none_9a882af90ea09cc3\f\ssh-add.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.19041.1081_none_5500d10e49b43346\f\ByteCodeGenerator.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..iondata-cmdlinetool_31bf3856ad364e35_10.0.19041.1202_none_fceb29af5a61f7e6\f\bcdedit.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\f\MicrosoftEdge.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-service_31bf3856ad364e35_10.0.19041.1202_none_d965e0f65a4ddcdf\BdeUISrv.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.19041.264_none_9627a04e40f9f001\f\SearchIndexer.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..randprintui-ntprint_31bf3856ad364e35_10.0.19041.1288_none_6f1fcb1866fcb4b8\f\ntprint.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft.powershell.pester_31bf3856ad364e35_10.0.19041.1_none_9478227a478f23d5\Pester.bat- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SystemApps\Microsoft.Windows.CapturePicker_cw5n1h2txyewy\CapturePicker.exe 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-d..ectxdatabaseupdater_31bf3856ad364e35_10.0.19041.84_none_2d21e26a18d595c7\r\directxdatabaseupdater.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..sistance-dcomserver_31bf3856ad364e35_10.0.19041.1110_none_a4bfcaa32abfcf0e\f\raserver.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-bootconfig_31bf3856ad364e35_10.0.19041.1_none_cc5c34dfee065cea\bootcfg.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-analog-facefodhandler_31bf3856ad364e35_10.0.19041.1_none_604b329da953cf68\FaceFodUninstaller.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..tionsimulationinput_31bf3856ad364e35_10.0.19041.746_none_492c8c53f3547077\f\PerceptionSimulationInput.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.19041.1202_none_dfaaff89afe4f3d4\f\vdsldr.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_multipoint-wmssessionagent_31bf3856ad364e35_10.0.19041.746_none_7f157730d01dcdae\r\WmsSessionAgent.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-openwith_31bf3856ad364e35_10.0.19041.746_none_556ec3cb05e3ec5a\OpenWith.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_10.0.19041.1_none_ba3fa9706f28b589\dplaysvr.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-browser-brokers_31bf3856ad364e35_11.0.19041.746_none_581ccf386ba57d51\browser_broker.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.264_none_4de8bd849baaa96f\f\WerFaultSecure.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msaudittools_31bf3856ad364e35_10.0.19041.546_none_f57e58b71b913c6b\auditpol.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.19041.1_none_b5ee49ccbbfbfddb\ssh.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.19041.964_none_9a882af90ea09cc3\ssh-keygen.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..pertiescomputername_31bf3856ad364e35_10.0.19041.1_none_f0b8ea270ffc4674\SystemPropertiesComputerName.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe- 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:556
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 9.6MB
- SHA256 f288bfc2a92fe9d6ef728e5eb3e32f516f47d9c8c5ef4d41edf15bd4a7809d5c
- MD5 ef2b1d53f5eb8f9809e42df4d46ae4c2
- SHA1 334c58e857b29801225be74e54ed926ec6055e97
- SHA512 ee01800a3d505b1ead94f2f4dfe27ba94735aa752fbffd5bc3abfc8732e933d9f51fd14ec98d751bd2b5143cf764bf10013c804af09c3c063172876418848245
- SSDEEP 98304:khpBinjOykGcPdOR5NTIOSAkdvjozRLL6kLapICjoR:8pAnjOyAdOrNTfgd7ozlL6kcI0oR
- TLSH T1D6A67C1272E00137D0A6917ACAA54725D7B13C7A4BF2C3DB7244B6D92E737C1BA36722
- MD5 SHA1 SHA512 SSDEEP TLSH