Analysis
- max time kernel
148s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 05:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
- Size 10.2MB
- Sample260802-glrf9sdp6w
- SHA256 2d62fd78f3867d4a9c4f201ced1b2db3814d47978670a9e380ef06c7c795feb6
- MD5 87a1554f332526d3f7943d680792602c
- SHA1 a383f850878014320d894597d41ce2d1a2b8b187
- SHA512 1ab60643d3790683fa8a5578a5166f4278faa1fd2cdc4390b58ca29daea3db67431319832f779c564b085a0ee76c12b6ce2857a079f40f16bab4145332c2e67b
- SSDEEP 98304:EcRGTJNjoyxQeMjLsAAa/7JNzJwjI5klUigb+q0XlBhs6sTIg/E8joX:3GTJJoReGZF6bUpbQvg82oX
- TLSH T16AB67B53FAB251E4C8BAC13886A26237BD71B85547309BD35A44962B0F33BF0AE3D754
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe smrss.exe" 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - Executes dropped EXE 1 IoCs
pid Process 2248 23444.exe - Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\smrss.exe 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\Classification\SenseCE.exe 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseIdentity.exe 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\java.exe 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files\Windows Defender\MpCopyAccelerator.exe 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4344 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe 4344 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe 4344 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe 4344 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe 4344 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe 4344 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe 4344 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe 4344 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe 4344 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe 4344 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe 4344 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe 4344 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe 4344 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe 4344 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe 4344 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe 4344 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe 4344 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe 4344 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe 4344 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe 4344 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe 4344 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe 4344 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe 4344 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe 4344 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe 4344 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe 4344 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe 4344 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe 4344 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe 4344 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe 4344 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe 4344 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe 4344 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe 4344 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe 4344 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe 4344 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe 4344 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe 4344 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe 4344 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe 4344 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe 4344 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe 4344 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe 4344 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe 4344 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe 4344 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe 4344 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe 4344 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe 4344 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe 4344 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe 4344 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe 4344 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe 4344 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe 4344 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe 4344 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe 4344 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe 4344 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe 4344 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe 4344 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe 4344 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe 4344 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe 4344 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe 4344 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe 4344 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe 4344 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe 4344 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4344 wrote to memory of 2248 4344 2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_87a1554f332526d3f7943d680792602c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\windows\temp\23444.exe"C:\windows\temp\23444.exe"2⤵
- Executes dropped EXE
PID:2248
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 12.3MB
- SHA256 520db206a6051dfcabd9f7b017ba040272c59b67bff29c70dc5fe54c06403392
- MD5 5e3e219419a331c228f1918714f95660
- SHA1 50588ccc0d42fdab121ddc1b39658b85a5208b22
- SHA512 3b5af1f0cf2c4e67cc145430fc8dc5ce1cba4b2d20c62e90504fe083903b8810531f80b560f9a9c2fc457b78edb5d98836aa0874309519a920d1635fe5973bb6
- SSDEEP 98304:EcRGTJNjoyxQeMjLsAAa/7JNzJwjI5klUigb+q0XlBhs6sTIg/E8jo7oq2Vjnmi:3GTJJoReGZF6bUpbQvg82o7GnX
- TLSH T16ED67C17FAB551E4C4BAC23886A26237FA71B85547309BD75644962B0F33BF0AE3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\23444.exe
- Size 549KB
- SHA256 707f415d7d581edd9bce99a0429ad4629d3be0316c329e8b9ebd576f7ab50b71
- MD5 0b24892597dcb0257cdb78b5ed165218
- SHA1 5fe5d446406ff1e34d2fe3ee347769941636e323
- SHA512 24ea9e0f10a283e67850070976c81ae4b2d4d9bb92c6eb41b2557ad3ae02990287531a619cf57cd257011c6770d4c25dd19c3c0e46447eb4d0984d50d869e56f
- SSDEEP 6144:vXREiNYVLKZn56Vq2UjCpd0v5prE6v0GSxWUPZl1JP+1Lix7NGZIVuXQ82g4zrr8:vXZNYVLeyUji0h90ZD0wxpGZIVuKrHs
- TLSH T1C1C40916F6748335D073C0B9C5D2A68EE972308657308ACB4286D77C7E67BE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH