Analysis
- max time kernel
150s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 23:47
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
- Size 9.5MB
- Sample260802-3stqvshe68
- SHA256 033a46b8b4b44ce8a053281791ccdec7219836dab33c04bfe35c798fbcca84dc
- MD5 ba6d972601bf665bb23ab382731dae50
- SHA1 ea23a38c4308ac9467d7abcf21e99787d9aee239
- SHA512 b6fa3acc0f5616517948da9bdc4881cecd6ecaf28c4ded32bd375c8058f1bd6e43ca8cfcf1631aec7907761a0ad432c81b085c68e80ffa9f1e4baeea25760825
- SSDEEP 98304:khpBinjOykGcPdOR5NTIOSAkdvjozRLzfkZcoLapIp:8pAnjOyAdOrNTfgd7ozlLPocIp
- TLSH T1BBA68D1272E00237E0A6917ACAA55725D7B13C3A4BF1C3DB7244B6D91E737C1BA36722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral2/files/0x0005000000016b4e-4.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral2/files/0x0005000000016b4e-4.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule behavioral2/files/0x0005000000016b4e-4.dat UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\wusa.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\diskpart.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\dplaysvr.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\setup16.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\DpiScaling.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\fsquirt.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\proquota.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\rasautou.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\rekeywiz.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\setx.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\winrshost.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cliconfg.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Com\comrepl.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\curl.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\help.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Msdtc\Trace\msdtcvtr.bat- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\notepad.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\regini.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Robocopy.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\calc.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\CheckNetIsolation.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\curl.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\fc.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\setupugc.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\shrpubw.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Taskmgr.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\expand.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\mountvol.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\NETSTAT.EXE 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\pcaui.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\tcmsetup.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wecutil.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ByteCodeGenerator.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\fixmapi.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\waitfor.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cttune.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\mavinject.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\mcbuilder.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\rasdial.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\regsvr32.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\schtasks.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\stordiag.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Windows.WARP.JITService.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ARP.EXE 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ctfmon.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\forfiles.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\more.com 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\raserver.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\systray.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\dcomcnfg.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\MRINFO.EXE 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\openfiles.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ReAgentc.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\attrib.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cttunesvr.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Windows Mail\wab.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Defender\mpextms.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Windows Media Player\wmpshare.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Windows Media Player\wmpshare.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseTVM.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Windows Media Player\setup_wm.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Media Player\wmprph.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\7-Zip\7zFM.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Defender\MpCopyAccelerator.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-provisioning-platform_31bf3856ad364e35_10.0.26100.1150_none_066fd0a833dca900\r\provlaunch.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\DataSvcUtil.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..e-licensing-service_31bf3856ad364e35_10.0.26100.1591_none_20144fc41cfe40b9\r\ClipDLS.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..ing-platform-client_31bf3856ad364e35_10.0.26100.1591_none_a525938a63d6ed42\r\licensingdiag.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-axinstallservice_31bf3856ad364e35_10.0.26100.1591_none_72c54a0c20f4219b\AxInstUI.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unp_31bf3856ad364e35_10.0.26100.1591_none_48bae61d0882b74d\r\UpdateNotificationMgr.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_windows-defender-service_31bf3856ad364e35_10.0.26100.1_none_c299cb2ebf592e77\MpCopyAccelerator.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.26100.1591_none_161bc21b2130ea78\r\WerFault.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CasPol.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_netfx4-vbc_exe_b03f5f7f11d50a3a_4.0.15912.355_none_8ee5d84e72880b3f\vbc.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-externaldictionary_31bf3856ad364e35_10.0.26100.1591_none_e2b02f289d06cfcc\IMEWDBLD.EXE- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wow64-legacy_31bf3856ad364e35_10.0.26100.1_none_f306a7a7706ba025\instnm.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.26100.1591_none_986ba09695018480\UevTemplateConfigItemGenerator.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sensordataservice_31bf3856ad364e35_10.0.26100.1150_none_99eb378dda259f30\SensorDataService.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.26100.1591_none_986ba09695018480\r\Microsoft.Uev.CscUnpinTool.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-dtc-runtime_31bf3856ad364e35_10.0.26100.1150_none_b53a535c0fece405\msdtc.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-certificateinstall_31bf3856ad364e35_10.0.26100.1591_none_d5752f789b3d8f3a\r\dmcertinst.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.26100.1591_none_37c9b95250fac754\r\perfmon.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_11.0.26100.1_none_6a9bcd9421c5bb20\ieUnatt.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-guestcomputeservice_31bf3856ad364e35_10.0.26100.1742_none_292a3be8c3034786\VmComputeAgent.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-onlinesetup-component_31bf3856ad364e35_10.0.26100.1591_none_08d143c7d80566f8\windeploy.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-icm-dccw_31bf3856ad364e35_10.0.26100.1150_none_b6d5fc573e6d363a\r\dccw.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-muicachebuilder_31bf3856ad364e35_10.0.26100.1150_none_b5f3ecb264c23d6b\r\mcbuilder.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lipboardredirection_31bf3856ad364e35_10.0.26100.1591_none_9d960bc9bb2901f9\rdpclip.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_aspnet_regsql_b03f5f7f11d50a3a_4.0.15912.355_none_cca5d427d5c6dc80\aspnet_regsql.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mschedexe_31bf3856ad364e35_10.0.26100.1_none_dc91fd1f1af84c4d\MSchedExe.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-packageinspector_31bf3856ad364e35_10.0.26100.1_none_6775b02f27bc2b3e\PackageInspector.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.26100.1_none_6c61929e721b6ffa\fsquirt.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ie-impexp-extexport_31bf3856ad364e35_11.0.26100.1_none_02c44855de8e9d74\ExtExport.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-timezone-sync_31bf3856ad364e35_10.0.26100.1591_none_2af0eb0ad05bac33\tzsync.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wrp-integrity-client_31bf3856ad364e35_10.0.26100.1591_none_c6fec8639b4d0909\sfc.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\x86_netfx35linq-linqwebconfig_31bf3856ad364e35_10.0.26100.1_none_f7e1c28598378da8\LinqWebConfig.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_10.0.26100.1591_none_88f13a0c22218100\r\IMJPUEX.EXE- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dpiscaling_31bf3856ad364e35_10.0.26100.1_none_773b7b96c37cb0e9\DpiScaling.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ktmutil_31bf3856ad364e35_10.0.26100.1150_none_24714894b112c0f3\ktmutil.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_10.0.26100.1150_none_1da178eaf53e7c4d\PrintBrmUi.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\x86_netfx4-vbc_exe_b03f5f7f11d50a3a_4.0.15912.355_none_d6930f2587043445\vbc.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-surrogate-core_31bf3856ad364e35_10.0.26100.1150_none_d0d1e07b8681fa6b\dllhost.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-surrogate_31bf3856ad364e35_10.0.26100.1150_none_e00b3f2ca36be9f9\r\dllhst3g.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.26100.1150_none_36fd183d90da21cb\r\tpmvscmgr.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-klist_31bf3856ad364e35_10.0.26100.1_none_3e2848112f1873ed\klist.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ork-uimanagerbroker_31bf3856ad364e35_10.0.26100.1150_none_15f982365a9d2243\UIMgrBroker.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..-disposableclientvm_31bf3856ad364e35_10.0.26100.1591_none_815687268bc7e515\r\WindowsSandboxClient.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-complus-setup_31bf3856ad364e35_10.0.26100.1150_none_858f29bf9f3816d2\mtstocom.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deviceproperties_31bf3856ad364e35_10.0.26100.1_none_e73e0b63a2759f40\DeviceProperties.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_11.0.26100.1_none_c99b7f92812c4030\iexplore.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.26100.1_none_11a8c65c8f61d5fb\dpnsvr.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\x86_netfx-aspnet_wp_exe_b03f5f7f11d50a3a_10.0.27000.313_none_a7d95898a02bb485\aspnet_wp.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pickerhost_31bf3856ad364e35_10.0.26100.1591_none_496d6688fe6244d2\PickerHost.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SystemApps\LKG\MicrosoftWindows.LKG.Search_cw5n1h2txyewy\MiniSearchHost.exe 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..sition-uicomponents_31bf3856ad364e35_10.0.26100.1150_none_6adbcfcc35357e97\wiaacmgr.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_netfx35linq-datasvcutil_31bf3856ad364e35_10.0.26100.1_none_8c4a868d0582d524\DataSvcUtil.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_windows-gaming-xbox..e-service-component_31bf3856ad364e35_10.0.26100.1591_none_ef25a80363f3d9ea\XblGameSaveTask.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.26100.1591_none_594e71c0d6ce5e62\r\mavinject.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-verclsid_31bf3856ad364e35_10.0.26100.1_none_c32f23e8b061a8a0\verclsid.exe- 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_ba6d972601bf665bb23ab382731dae50_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5268
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 10.4MB
- SHA256 56342ede44867d5c2f4ce4497dc4868e07e2f70d9a63ed51733c8f7216df517d
- MD5 37dd01e98667f6bb353c59049b57fdf7
- SHA1 7f08b1b3bf4611d4c156a34f1735bc4e04657f83
- SHA512 b2c17d32c8095f7bfa5db2f8d03e1234d368f9bbafd9176caff96f8a41ec4623be4aac5a5a9d41b55b949ee6fe423d5c7b03b25b9d5c2bd2867461715f4b0bb4
- SSDEEP 98304:khpBinjOykGcPdOR5NTIOSAkdvjozRLzfkZcoLapIGezSC6v2XMHt:8pAnjOyAdOrNTfgd7ozlLPocIlK
- TLSH T160B67D1272E44237D0B6917ACAA65725E7B13C3A4BB1C3CB7244B6DD2E337C1A536722
- MD5 SHA1 SHA512 SSDEEP TLSH