Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/08/2026, 23:47
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
- Size 9.5MB
- Sample260802-3stqvshe68
- SHA256 033a46b8b4b44ce8a053281791ccdec7219836dab33c04bfe35c798fbcca84dc
- MD5 ba6d972601bf665bb23ab382731dae50
- SHA1 ea23a38c4308ac9467d7abcf21e99787d9aee239
- SHA512 b6fa3acc0f5616517948da9bdc4881cecd6ecaf28c4ded32bd375c8058f1bd6e43ca8cfcf1631aec7907761a0ad432c81b085c68e80ffa9f1e4baeea25760825
- SSDEEP 98304:khpBinjOykGcPdOR5NTIOSAkdvjozRLzfkZcoLapIp:8pAnjOyAdOrNTfgd7ozlLPocIp
- TLSH T1BBA68D1272E00237E0A6917ACAA55725D7B13C3A4BF1C3DB7244B6D91E737C1BA36722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral1/files/0x000d000000024385-4.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Custom signatureDetects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral1/files/0x000d000000024385-4.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Custom signatureUPX dump on OEP (original entry point) 1 IoCs
resource yara_rule behavioral1/files/0x000d000000024385-4.dat UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\shrpubw.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\autofmt.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\bthudtask.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cliconfg.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\tracerpt.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\openfiles.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\RMActivate_ssp_isv.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\tcmsetup.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\appidtel.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\driverquery.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\eudcedit.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\chkdsk.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cmdkey.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\diskperf.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\extrac32.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\format.com- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ieUnatt.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\instnm.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\PkgMgr.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\dllhost.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\isoburn.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\winver.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\OpenWith.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\provlaunch.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\secinit.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\shutdown.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\stordiag.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\tracerpt.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\doskey.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\edpnotify.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wsmprovhost.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\icsunattend.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\logagent.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\mavinject.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\TRACERT.EXE 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\winrshost.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\write.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\fontdrvhost.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\gpresult.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\iexpress.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Taskmgr.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\relog.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\auditpol.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\bitsadmin.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\credwiz.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cttunesvr.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\explorer.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\show_third_party_software_licenses.bat 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Windows Media Player\wmprph.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Windows Media Player\setup_wm.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\show_third_party_software_licenses.bat 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\ink\mip.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Internet Explorer\ielowutil.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.19041.1266_none_8a8440f738abd1b9\wmpshare.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..extservice.appxmain_31bf3856ad364e35_10.0.19041.423_none_2cade1bc915dca0d\Microsoft.AsyncTextService.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.19041.1110_none_20a89186aedb6af7\msinfo32.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lishing-wmiprovider_31bf3856ad364e35_10.0.19041.1_none_eb29661c32e6a63a\rdpsign.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..client-decoder-host_31bf3856ad364e35_10.0.19041.207_none_00b5dbdfab19326f\r\UtcDecoderHost.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_networking-mpssvc-netsh_31bf3856ad364e35_10.0.19041.1151_none_23c0aa3b7bd960cd\r\CheckNetIsolation.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..perience-ait-static_31bf3856ad364e35_10.0.19041.1202_none_a5a4c3f2637b55fa\r\aitstatic.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.19041.264_none_3f30ef10158954bf\CustomInstallExec.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..alenrollmentmanager_31bf3856ad364e35_10.0.19041.264_none_839983ebef167c68\f\CredentialEnrollmentManager.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ed-chinese-moimeexe_31bf3856ad364e35_10.0.19041.746_none_c3054a007d804943\ChsIME.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasautodial_31bf3856ad364e35_10.0.19041.1_none_c5cb0c3a04b0a5de\rasautou.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-webauth_31bf3856ad364e35_10.0.19041.746_none_099c40ad55bc5d6c\f\AuthHost.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.19041.1266_none_5fd6523a3130632d\r\systemreset.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-b..nfrastructurebghost_31bf3856ad364e35_10.0.19041.546_none_5940d1a4fc4ad8f3\r\backgroundTaskHost.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-u..ountcontrolsettings_31bf3856ad364e35_10.0.19041.1_none_43eac9c1ac59d1f0\UserAccountControlSettings.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.19041.264_none_9627a04e40f9f001\f\SearchIndexer.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.19041.928_none_33e0d5558cdd7c61\CExecSvc.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..ing-platform-client_31bf3856ad364e35_10.0.19041.1266_none_7e2b6be969016c27\f\licensingdiag.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..s-datausagehandlers_31bf3856ad364e35_10.0.19041.746_none_dbecc8a3cdc7c3cf\r\DataUsageLiveTileTask.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_10.0.19041.1266_none_2d0e4759c01cf211\unregmp2.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CasPol.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deviceproperties_31bf3856ad364e35_10.0.19041.1_none_a03b7086d9468b36\DeviceProperties.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..mpropertiesadvanced_31bf3856ad364e35_10.0.19041.1_none_ad39955b83a3f25f\SystemPropertiesAdvanced.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.19041.1288_none_1cec63974464878f\SenseCncProxy.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.19041.1202_none_324ea383dbfddeb9\mavinject.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appresolverux.appxmain_31bf3856ad364e35_10.0.19041.423_none_df344b9fe5390f25\f\AppResolverUX.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..dialoghost.appxmain_31bf3856ad364e35_10.0.19041.423_none_edab5dd3a4c202d9\CredDialogHost.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-convert_31bf3856ad364e35_10.0.19041.1266_none_119b1e415d838a28\r\autoconv.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.19041.1151_none_ec390bd802a1c630\f\SearchFilterHost.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-commandprompt_31bf3856ad364e35_10.0.19041.746_none_735abbdbad8c902f\f\cmd.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SystemApps\Windows.CBSPreview_cw5n1h2txyewy\CameraBarcodeScannerPreview.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.19041.746_none_7c508e4438cec899\changepk.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_multimedia-rrinstaller_31bf3856ad364e35_10.0.19041.1_none_d333642c61130785\rrinstaller.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_9aa166e99861c2bc\chgusr.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft.windows.winhttp_31bf3856ad364e35_5.1.19041.1151_none_d57e154a0a8460d3\f\pacjsworker.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\Temp\PendingDeletes\b6c0024236e5d701eb9600001815341f.CustomShellHost.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.19041.1237_none_b40cbfe2afd2c015\f\wowreg32.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-c..periencehost-broker_31bf3856ad364e35_10.0.19041.746_none_1ce3c0f12fb5f8ec\CloudExperienceHostBroker.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..tionsnonwinpeplugin_31bf3856ad364e35_10.0.19041.1_none_5c82be53abe61670\PnPUnattend.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.1081_none_2e31e8eed4b770c3\r\WMIADAP.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..-commandline-dsdiag_31bf3856ad364e35_10.0.19041.1_none_a6017688e5093466\dcdiag.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bootconfig_31bf3856ad364e35_10.0.19041.1_none_c2078a8db9a59aef\bootcfg.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.19041.746_none_7a0308f7ffc334d5\perfmon.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-recdisc-main_31bf3856ad364e35_10.0.19041.84_none_7c1f17a9e1beaf63\r\recdisc.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..msettings-datamodel_31bf3856ad364e35_10.0.19041.746_none_c82b4b805b9ae361\SystemSettingsBroker.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ecapp.appxmain_31bf3856ad364e35_10.0.19041.1_none_b30156e32b833fb0\Microsoft.ECApp.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-csp_31bf3856ad364e35_10.0.19041.844_none_c606f47e6aa94b5b\r\hvsievaluator.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-lsatrustlet_31bf3856ad364e35_10.0.19041.1288_none_5961108733e967c9\f\LsaIso.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..rvices-sessionagent_31bf3856ad364e35_10.0.19041.1_none_3b97be772075a03a\RdpSa.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lipboardredirection_31bf3856ad364e35_10.0.19041.746_none_dfcf5b6f69f16f7a\rdpclip.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.19041.264_none_9627a04e40f9f001\SearchProtocolHost.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-waitfor_31bf3856ad364e35_10.0.19041.1_none_6c56c3651a911f63\waitfor.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-notepad_31bf3856ad364e35_10.0.19041.1081_none_e3f87355251e8c43\r\notepad.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..-commandline-editor_31bf3856ad364e35_10.0.19041.1_none_e7854180ca0cff60\reg.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.19041.1266_none_eb6597ac99d11603\f\audiodg.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-complus-ui_31bf3856ad364e35_10.0.19041.1_none_6698d138e79617d9\dcomcnfg.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_10.0.19041.746_none_5fb37340a423d88f\f\PrintBrmEngine.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_windows-gaming-xbox..e-service-component_31bf3856ad364e35_10.0.19041.789_none_3136b8d712da0334\XblGameSaveTask.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..randprintui-ntprint_31bf3856ad364e35_10.0.19041.1288_none_6f1fcb1866fcb4b8\r\ntprint.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4496
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 10.0MB
- SHA256 e7b384f38be8687fc89aa60cf221257f0352174142644c5cab921034aa01dfd6
- MD5 ec036e82cf6aa789f6c891e9e997cf91
- SHA1 a6eb6a3cefd8e26dd4d3e808f9a0e3f498edb342
- SHA512 602422c7aad7c7571fdc3996a5ebe1033c3074d401c1109bb6685ec05358286da4b05b9cc3f49f305a597e80ebbc8467226fa378615d3e095f3b18814c9b1868
- SSDEEP 98304:khpBinjOykGcPdOR5NTIOSAkdvjozRLzfkZcoLapI9joM:8pAnjOyAdOrNTfgd7ozlLPocI5oM
- TLSH T148B67C12B2E40237D0B6917ACAA55725D7B13C3A4BB1C3CB7244B6DD1E737C1AA36722
- MD5 SHA1 SHA512 SSDEEP TLSH