Analysis
- max time kernel
150s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/08/2026, 17:01
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe
- Size 11.7MB
- Sample260803-vjnjgstdrc
- SHA256 80d68c29bf283f2f6912551139968c3158a1bc8e89e7022412d366357c641fbc
- MD5 bebfabf43387a40ff61f01de3bfd12b2
- SHA1 abd0f4af2eb93f331d958064c9bcaae3d69e0c10
- SHA512 bdf16ce8010b6b3ddf295e68d0b9a2762b956d6664096c74852a6ca7eb3176ea846765aecd0861e80d49bd1c8bd648d58a73317c5c345d488d76305c55ea9f67
- SSDEEP 98304:kIOERqd/6hkB/qoHMdnJE7hAlKnsz2C2PYdhIqHpnq0E4jovLapID6bTIOSAB:SEYd/6ZJEul4szEonqtaovcID6bTfV
- TLSH T103C69E3275D58136D1664135CAA56FB4C3A47C3A4BF182CB76807AEE5A723C27D32B23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral2/files/0x000d00000001c5df-4.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral2/files/0x000d00000001c5df-4.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\cleanmgr.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\credwiz.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\curl.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\Magnify.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\net1.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\resmon.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\systeminfo.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\typeperf.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\isoburn.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\TCPSVCS.EXE- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\whoami.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\win32calc.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\dcomcnfg.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\mmc.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\unlodctr.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\winver.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\WWAHost.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\format.com 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\netbtugc.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\regsvr32.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\unregmp2.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\Fondue.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\logman.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\mstsc.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\wscadminui.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\runas.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\sxstrace.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\dllhst3g.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\mspaint.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\RMActivate.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\TRACERT.EXE- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\xwizard.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\mode.com- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\msinfo32.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\getmac.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\tasklist.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\upnpcont.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\poqexec.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\raserver.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\doskey.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\GamePanel.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\mavinject.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\recover.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\relog.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\user.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\RdpSa.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\tttracer.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\mmgaserver.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\tcmsetup.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\extrac32.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\netsh.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\sfc.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\choice.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\extrac32.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\fsutil.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Windows Defender\MpDlpService.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Windows Defender\MpDlpCmd.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Windows Media Player\wmprph.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Windows Media Player\wmplayer.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Windows Media Player\wmplayer.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Windows Media Player\wmpshare.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\uninstall.cmd 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-containers-ccg_31bf3856ad364e35_10.0.26100.1591_none_f83c41b7a549ff24\CCG.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-ksetup_31bf3856ad364e35_10.0.26100.1150_none_b8541704fe1248c2\ksetup.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_ce938c0efedcde06\r\TCPSVCS.EXE- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_regsvcs_b03f5f7f11d50a3a_4.0.15912.0_none_47183375504a1255\RegSvcs.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-cleanmgr_31bf3856ad364e35_10.0.26100.1_none_748c8913fa792db3\cleanmgr.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\x86_microsoft-windows-i..devicescontrolpanel_31bf3856ad364e35_10.0.26100.1_none_c574d8b0f950d6dd\ImagingDevices.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-onlinesetup-component_31bf3856ad364e35_10.0.26100.1591_none_08d143c7d80566f8\windeploy.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-runonce_31bf3856ad364e35_10.0.26100.1591_none_b17acfc36f0ec944\r\runonce.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..up-deviceencryption_31bf3856ad364e35_10.0.26100.1591_none_7622b05853a7428c\BitLockerDeviceEncryption.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winlogon_31bf3856ad364e35_10.0.26100.1301_none_0b8f997b84f03748\winlogon.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1150_none_553b538bcf828876\r\WMIADAP.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-htmlhelp_31bf3856ad364e35_10.0.26100.1591_none_6e6a9c2b69241453\hh.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dfsvc.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\vbc.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-synchost_31bf3856ad364e35_10.0.26100.1150_none_05685d8fac7c4f66\r\SyncHost.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-terminalservices-theme_31bf3856ad364e35_10.0.26100.1150_none_71cd60532ab93f47\r\TSTheme.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-verclsid_31bf3856ad364e35_10.0.26100.1_none_b8da79967c00e6a5\verclsid.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_multimedia-windows-..n-playready-desktop_31bf3856ad364e35_10.0.26100.1150_none_d50cb16c6bb0fec5\prproc.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_aspnet_regsql_b03f5f7f11d50a3a_4.0.15912.0_none_d691427f65d1362f\aspnet_regsql.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.26100.1591_none_10f229073c0ac263\SearchIndexer.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_userexperience-oobe_31bf3856ad364e35_10.0.26100.1591_none_54983d2d7a4908c4\OOBE\OobeHostApp.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ServiceModelReg.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..roblemstepsrecorder_31bf3856ad364e35_10.0.26100.1591_none_76b18c52fb009a32\r\psr.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wow64-legacy_31bf3856ad364e35_10.0.26100.1_none_f306a7a7706ba025\setup16.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-embedded-bootexp_31bf3856ad364e35_10.0.26100.1150_none_6548a7f0b3a3e4e1\r\BootExpCfg.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mdmappinstaller_31bf3856ad364e35_10.0.26100.1591_none_356e88b34c16567d\r\MDMAppInstaller.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-provisioning-core_31bf3856ad364e35_10.0.26100.1591_none_538f0058df8c2519\provtool.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-o..onalfeatures-fondue_31bf3856ad364e35_10.0.26100.1_none_50fd5fe72912c2cf\Fondue.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\x86_netfx-dw_b03f5f7f11d50a3a_10.0.26100.1_none_71dc1710cec228ac\dw20.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\x86_netfx4-aspnet_regiis_exe_b03f5f7f11d50a3a_4.0.15912.0_none_cadd49f9437f4c64\aspnet_regiis.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SystemApps\Microsoft.Windows.FileExplorer_cw5n1h2txyewy\FileExplorer.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.26100.1150_none_06d22316aa9884bc\r\vds.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.26100.712_none_231685f601e78e59\SpatialAudioLicenseSrv.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-pnp-drvinst_31bf3856ad364e35_10.0.26100.1591_none_f11dd8b719f1a6f5\drvinst.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1738_none_48e47fdfbf0a33b1\TiWorker.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-pnp-drvinst_31bf3856ad364e35_10.0.26100.1591_none_f11dd8b719f1a6f5\r\drvinst.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-autochk_31bf3856ad364e35_10.0.26100.1_none_dee795aa2a4dbd74\autochk.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-findstr_31bf3856ad364e35_10.0.26100.1150_none_c316dbd9099e9007\r\findstr.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_10.0.26100.1_none_91c8eae9745a351d\SystemPropertiesRemote.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-d..ectxdatabaseupdater_31bf3856ad364e35_10.0.26100.1591_none_d13ec0589abf0359\r\directxdatabaseupdater.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-calc_31bf3856ad364e35_10.0.26100.1_none_a6b1a99b83489282\calc.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..d-searchintegration_31bf3856ad364e35_10.0.26100.1591_none_2177acc33f68854a\IMESEARCH.EXE- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-edge-microsoftedgecp_31bf3856ad364e35_10.0.26100.1150_none_5d1d8fd6c1063afd\r\MicrosoftEdgeCP.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-starttiledata_31bf3856ad364e35_10.0.26100.1591_none_2c8539fa8a63de14\DataStoreCacheDumpTool.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sethc_31bf3856ad364e35_10.0.26100.1591_none_08d4e4725982e790\r\sethc.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..onment-core-tcbboot_31bf3856ad364e35_10.0.26100.1742_none_9c21c77df9054577\tcblaunch.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-embedded-shelllauncher_31bf3856ad364e35_10.0.26100.1150_none_e04006fcf72e00e6\r\eshell.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.26100.1150_none_d7504f768bde2804\gpresult.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-packagemanager_31bf3856ad364e35_10.0.26100.1591_none_8897bf42a34b1ceb\r\PkgMgr.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_ce938c0efedcde06\ROUTE.EXE- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..sition-uicomponents_31bf3856ad364e35_10.0.26100.1150_none_6adbcfcc35357e97\wiaacmgr.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-more_31bf3856ad364e35_10.0.26100.1_none_b3a2a31db5fc0bbd\more.com- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_d8e83661333da001\r\ROUTE.EXE- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.26100.1591_none_986ba09695018480\r\UevTemplateConfigItemGenerator.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audit-component_31bf3856ad364e35_10.0.26100.1_none_a3abe7a4df6b292a\audit.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-blb-engine-main_31bf3856ad364e35_10.0.26100.1591_none_7fa1f11eafc6c01d\wbengine.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-unifiedwritefilter_31bf3856ad364e35_10.0.26100.1591_none_37fa9a7337d181ee\UwfServicingShell.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-magnify_31bf3856ad364e35_10.0.26100.1591_none_09edd29348b6b707\Magnify.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.26100.1455_none_b184dc3c337d380b\r\wmpconfig.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\x86_wpf-xamlviewer_31bf3856ad364e35_10.0.26100.1_none_f6e3595e2d1c0bde\XamlViewer_v0300.exe- 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\notepad.exe 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4620
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 12.6MB
- SHA256 c349e34d2f74cbfd14c77f26cab798c226d199e17802de3e15ce5ba2168ff102
- MD5 fded1b3a72e22e595d3c547552d1bd8d
- SHA1 762511a6c6550ccab94297ad07c583f9e5fdf017
- SHA512 fc44e8c901d7882d7efd4869eca15b5b26c558ef5131060172e04bddb68b81f90e2d47a2c1a1110d3cd7f2edd92bf48d818e74497ab21114310ebaa553ce5a23
- SSDEEP 98304:kIOERqd/6hkB/qoHMdnJE7hAlKnsz2C2PYdhIqHpnq0E4jovLapID6bTIOSAuezn:SEYd/6ZJEul4szEonqtaovcID6bTfB9
- TLSH T1FCD69E3175E5C136D1668075CAA56FB5C2B57C364BF186CB7280BAAD1E323C27932B23
- MD5 SHA1 SHA512 SSDEEP TLSH