Analysis
- max time kernel
149s - max time network
96s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
03/08/2026, 17:01
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe
- Size 11.7MB
- Sample260803-vjnjgstdrc
- SHA256 80d68c29bf283f2f6912551139968c3158a1bc8e89e7022412d366357c641fbc
- MD5 bebfabf43387a40ff61f01de3bfd12b2
- SHA1 abd0f4af2eb93f331d958064c9bcaae3d69e0c10
- SHA512 bdf16ce8010b6b3ddf295e68d0b9a2762b956d6664096c74852a6ca7eb3176ea846765aecd0861e80d49bd1c8bd648d58a73317c5c345d488d76305c55ea9f67
- SSDEEP 98304:kIOERqd/6hkB/qoHMdnJE7hAlKnsz2C2PYdhIqHpnq0E4jovLapID6bTIOSAB:SEYd/6ZJEul4szEonqtaovcID6bTfV
- TLSH T103C69E3275D58136D1664135CAA56FB4C3A47C3A4BF182CB76807AEE5A723C27D32B23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral1/files/0x000a000000023fe5-4.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral1/files/0x000a000000023fe5-4.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\fsutil.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\w32tm.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\certutil.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\autofmt.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\bitsadmin.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\credwiz.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\doskey.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\MRINFO.EXE 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\msra.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\explorer.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\isoburn.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\netbtugc.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\ntprint.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\RmClient.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\schtasks.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\cscript.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\dllhost.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\DWWIN.EXE- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\gpscript.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\rasphone.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\RMActivate.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\wiaacmgr.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\appidtel.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\mmc.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\mmgaserver.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\mspaint.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\ndadmin.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\PickerHost.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\sort.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\wowreg32.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\wscadminui.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\ARP.EXE- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\ddodiag.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\DWWIN.EXE 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\where.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\CloudNotifications.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\PickerHost.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\wecutil.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\wlanext.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\cacls.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\eventvwr.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\tracerpt.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\charmap.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\at.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\bootcfg.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\print.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\systray.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\calc.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\cmstp.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\gpresult.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\logman.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\TRACERT.EXE 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\dxdiag.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\proquota.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Common Files\microsoft shared\ink\mip.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Windows Media Player\setup_wm.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\show_third_party_software_licenses.bat- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\show_third_party_software_licenses.bat- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\elevation_service.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Windows Media Player\wmprph.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-pcwdiagnostic_31bf3856ad364e35_10.0.19041.1266_none_69f1a169b4d96a7c\f\pcwrun.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-gdi_31bf3856ad364e35_10.0.19041.264_none_920963acedc8777d\fontdrvhost.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.19041.928_none_b321f2c2ab7710a2\sdbinst.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.19041.1_none_805682e34c6552d0\winrm.cmd- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_10.0.19041.1266_none_2d0e4759c01cf211\setup_wm.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..alservices-webproxy_31bf3856ad364e35_10.0.19041.746_none_0f70f5a5b71ec478\TSWbPrxy.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_10.0.19041.1266_none_2d0e4759c01cf211\f\setup_wm.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-secinit_31bf3856ad364e35_10.0.19041.1_none_47fda84da0bc8185\secinit.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-upnpdevicehost_31bf3856ad364e35_10.0.19041.153_none_aa284d65c7bee591\f\upnpcont.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.19041.173_none_38fc88f8cb913df1\winload.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-upnpdevicehost_31bf3856ad364e35_10.0.19041.153_none_9fd3a313935e2396\r\upnpcont.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ie-feedsbs_31bf3856ad364e35_11.0.19041.1_none_8a11dbe22c9bf6e1\msfeedssync.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-containerdiagnosticstool_31bf3856ad364e35_10.0.19041.928_none_6571ff6e96271a64\r\hcsdiag.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasautodial_31bf3856ad364e35_10.0.19041.1_none_c5cb0c3a04b0a5de\rasautou.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\f\AppVStreamingUX.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_ef0e010d1381269b\r\aspnetca.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.19041.1_none_ed4924afa14354c2\sdchange.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..andlinepropertytool_31bf3856ad364e35_10.0.19041.844_none_f3894559140c31d7\r\imjpuexc.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-u..onwakesettingflyout_31bf3856ad364e35_10.0.19041.1_none_6c93021db54246b0\PasswordOnWakeSettingFlyout.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..lity-eoaexperiences_31bf3856ad364e35_10.0.19041.153_none_c283d2cf01b0b7d8\EoAExperiences.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.19041.173_none_38fc88f8cb913df1\r\winload.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-embedded-shelllauncher_31bf3856ad364e35_10.0.19041.1202_none_b918e36ffc7a6ffe\eshell.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-getmac_31bf3856ad364e35_10.0.19041.1_none_c1efa43e415898e4\getmac.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..nsimulation-service_31bf3856ad364e35_10.0.19041.746_none_b6b8620636970859\f\PerceptionSimulationService.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-runonce_31bf3856ad364e35_10.0.19041.1202_none_8a7b0186743e499b\r\runonce.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.1202_none_2dfbb21bd5166adc\r\Taskmgr.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ndowmanager-process_31bf3856ad364e35_10.0.19041.746_none_11e04cec24452336\r\dwm.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_3f1cc1d15da468cf\f\typeperf.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setupcl_31bf3856ad364e35_10.0.19041.1_none_0ea013578aa5744f\setupcl.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ork-uimanagerbroker_31bf3856ad364e35_10.0.19041.388_none_57e235d809a12c5b\r\UIMgrBroker.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_comsvcconfig_b03f5f7f11d50a3a_4.0.15805.0_none_468e01fabfc37212\ComSvcConfig.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.19041.746_none_790f12933fbf7e0d\tpmvscmgr.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-axinstallservice_31bf3856ad364e35_10.0.19041.867_none_b4e9fc09cfcbdd7c\r\AxInstUI.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bioenrollment.appxmain_31bf3856ad364e35_10.0.19041.844_none_de5d9fe254d9f8c4\r\BioEnrollmentHost.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-magnify_31bf3856ad364e35_10.0.19041.1266_none_e2f3aaf24de135ec\r\Magnify.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.262_none_e73f0197262d9fec\TiWorker.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_10.0.19041.264_none_be8a8ad4892e651d\printui.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-snippingtool-app_31bf3856ad364e35_10.0.19041.1_none_4fb50fb329007a5d\SnippingTool.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_9aa166e99861c2bc\tskill.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-terminalservices-theme_31bf3856ad364e35_10.0.19041.1_none_8bd71d601a2cdd3f\TSTheme.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_netfx4-aspnet_regiis_exe_b03f5f7f11d50a3a_4.0.15805.0_none_814c9c8a31da2279\aspnet_regiis.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\msil_addinutil_b77a5c561934e089_10.0.19041.1_none_724c73dbde296e25\AddInUtil.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..randprintui-ntprint_31bf3856ad364e35_10.0.19041.1288_none_64cb20c6329bf2bd\r\ntprint.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.19041.746_none_790f12933fbf7e0d\f\tpmvscmgrsvr.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SystemApps\Microsoft.AccountsControl_cw5n1h2txyewy\AccountsControlHost.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..e-client-ui-wsreset_31bf3856ad364e35_10.0.19041.746_none_a47144c464d15475\f\WSReset.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-extcom_31bf3856ad364e35_10.0.19041.1202_none_7f995fddf54c000c\SppExtComObj.Exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lockapphost_31bf3856ad364e35_10.0.19041.1_none_b19798c3028c2929\LockAppHost.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..tionsimulationinput_31bf3856ad364e35_10.0.19041.746_none_492c8c53f3547077\PerceptionSimulationInput.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-certificaterequesttool_31bf3856ad364e35_10.0.19041.1_none_28564b59eb268cda\certreq.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ac-sql-cliconfg-exe_31bf3856ad364e35_10.0.19041.1_none_3062feae2a702d0a\cliconfg.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.19041.1_none_330dfb2b06b21af6\find.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sysprep_31bf3856ad364e35_10.0.19041.746_none_cd77eb91574a2623\r\sysprep.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-certutil_31bf3856ad364e35_10.0.19041.746_none_9dd2fd0bc68c998c\certutil.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-diskpart_31bf3856ad364e35_10.0.19041.964_none_510ebdd9292eed06\f\diskpart.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_addinprocess32_b77a5c561934e089_10.0.19041.1_none_3700bdc08c446a5c\AddInProcess32.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..perience-ait-static_31bf3856ad364e35_10.0.19041.1202_none_a5a4c3f2637b55fa\f\aitstatic.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..andlinepropertytool_31bf3856ad364e35_10.0.19041.844_none_e9349b06dfab6fdc\f\imjpuexc.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-optionaltsps_31bf3856ad364e35_10.0.19041.1_none_97ed4bc868404e31\tcmsetup.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tasklist_31bf3856ad364e35_10.0.19041.1_none_e888ea072e0fed05\tasklist.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-scripting_31bf3856ad364e35_10.0.19041.1237_none_bd2b0ef5b58e1540\wscript.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-spectrum_31bf3856ad364e35_10.0.19041.153_none_59d1094dec9b8480\r\Spectrum.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\msil_servicemodelreg_b03f5f7f11d50a3a_10.0.19041.1_none_0bb55a3e8d066c16\ServiceModelReg.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SystemApps\ParentalControls_cw5n1h2txyewy\WpcUapApp.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4116
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 12.2MB
- SHA256 130e15425e7b9df1d3f2c55b0cb1972fe286a6497fcc44bb6ffd1943b0414b13
- MD5 1444299ddb82950706e302294bc2b580
- SHA1 e400be81a5492cb2c4d05d187e3cff37f8d899aa
- SHA512 6d4145d2c0d913e56c3ed70bc60e9e76faa091c626b8c777df25f09416ce84b559b83001162d3f7f683d3c28c21924189a9275bf7c3357f0397f3f61cffa972a
- SSDEEP 98304:kIOERqd/6hkB/qoHMdnJE7hAlKnsz2C2PYdhIqHpnq0E4jovLapID6bTIOSA1joj:SEYd/6ZJEul4szEonqtaovcID6bTf1oj
- TLSH T1E0D69E3275E58135D1664075CAA56FB5C3A47C3A4BF182CB7680BAED1E723C27932B23
- MD5 SHA1 SHA512 SSDEEP TLSH