Analysis
- max time kernel
149s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/08/2026, 11:28
Behavioral task
behavioral1
Sample
2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe
- Size 12.4MB
- Sample260804-nlcrfaac95
- SHA256 8a17686dbab9e92eea477c5b8f3d1f2b79533a5dfb8eef098af19d7717bad823
- MD5 6c91c30e3c154c69b5f347371eed692d
- SHA1 e5372e7493e9b43b46e933e15d54c5ccfcedcda6
- SHA512 16c1f4c2a9990def3b64dbe9b77a62694a34ce036e666870cd324cb8b095ee17ea876d1e0e83b4442e45e08c009708103a3397a705320eae5399df4b9d0af26e
- SSDEEP 196608:Tpdyn8OyJgV9z8bdsosEU8IBtz/WyZ/K0ttYVAATm60Jo3:FdyndVosEU8IBJuyZ/K0ttYZThx3
- TLSH T165D69E13F2A402F5D0B7D178CA629222EB727C5547B196CF2294B6E81F73AD06F39721
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule behavioral1/files/0x00180000000243ca-5.dat UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\doskey.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\gpupdate.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\pcaui.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\shutdown.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\xcopy.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\chcp.com- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\cmdl32.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\rasdial.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\waitfor.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\format.com 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\Msdtc\Trace\msdtcvtr.bat 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\Utilman.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\eudcedit.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\sfc.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\certutil.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\mmc.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\newdev.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\timeout.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\waitfor.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\Windows.WARP.JITService.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\bthudtask.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\calc.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\gpupdate.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\label.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\takeown.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\find.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\odbcad32.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\getmac.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\attrib.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\charmap.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\DWWIN.EXE- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\esentutl.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\findstr.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\ieUnatt.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\openfiles.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\edpnotify.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\print.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\rasdial.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\taskkill.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\tasklist.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\Taskmgr.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\auditpol.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\logagent.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\upnpcont.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\control.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\dccw.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\icacls.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\makecab.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\mcbuilder.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\PATHPING.EXE- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\rekeywiz.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe -
resource yara_rule behavioral1/memory/3940-0-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/files/0x00180000000243ca-5.dat upx behavioral1/memory/3940-544-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/3940-545-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/3940-1205-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/3940-1674-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/3940-2180-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/3940-2730-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/3940-3231-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/3940-3232-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/3940-3233-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/3940-3237-0x0000000000400000-0x000000000040F000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\javap.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Mozilla Firefox\nmhproxy.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{5FB3EC02-3BC2-42B4-ADB2-E7E67AAED99F}\MicrosoftEdge_X64_139.0.3405.125.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{5FB3EC02-3BC2-42B4-ADB2-E7E67AAED99F}\MicrosoftEdge_X64_139.0.3405.125.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\dotnet\dotnet.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Windows Mail\wab.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Common Files\microsoft shared\ink\mip.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Windows Media Player\wmprph.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Internet Explorer\iexplore.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Windows Media Player\wmlaunch.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\7-Zip\7zG.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\elevation_service.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\7-Zip\Uninstall.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Windows Media Player\wmplayer.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.19041.1151_none_ec390bd802a1c630\r\SearchFilterHost.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-cloudnotifications_31bf3856ad364e35_10.0.19041.746_none_7a559100246cff2b\CloudNotifications.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-utilman_31bf3856ad364e35_10.0.19041.746_none_eaf7a50dc46d5592\r\Utilman.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-x..rtificateenrollment_31bf3856ad364e35_10.0.19041.746_none_dbe4ac1121d6e6d7\r\CertEnrollCtrl.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dispdiag_31bf3856ad364e35_10.0.19041.1_none_fad576d8cf74b38a\dispdiag.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-notepad_31bf3856ad364e35_10.0.19041.117_none_4d353cf1ceb5d6d2\f\notepad.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-notepad_31bf3856ad364e35_10.0.19041.117_none_4d353cf1ceb5d6d2\r\notepad.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-guestcomputeservice_31bf3856ad364e35_10.0.19041.264_none_6b6699b671c8f5a8\VmComputeAgent.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dxp-deviceexperience_31bf3856ad364e35_10.0.19041.746_none_251e769058968366\f\Dxpserver.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_3f1cc1d15da468cf\f\relog.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..nt-enrollmenthelper_31bf3856ad364e35_10.0.19041.746_none_18c3ddf7dbfedda0\PinEnrollmentBroker.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sigverif_31bf3856ad364e35_10.0.19041.1_none_718a91e09abc2926\sigverif.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..nputpersonalization_31bf3856ad364e35_10.0.19041.746_none_1da55dc225237a0d\InputPersonalization.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-autoplay_31bf3856ad364e35_10.0.19041.1266_none_9a152e76298cd801\wmlaunch.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\x86_netfx4-ngentask_exe_b03f5f7f11d50a3a_4.0.15805.0_none_1bb0d4ac7da3bfe1\ngentask.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\AppVShNotify.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tpm-tool_31bf3856ad364e35_10.0.19041.1202_none_72f9f7c7a1b307dd\f\TpmTool.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_windows.networking.vpn.nethost_31bf3856ad364e35_10.0.19041.1_none_836cd009a39b05c6\NetHost.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-international-unattend_31bf3856ad364e35_10.0.19041.906_none_a892faef80a943dc\MuiUnattend.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-notepad_31bf3856ad364e35_10.0.19041.1081_none_e3f87355251e8c43\r\notepad.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-uso-dtuhandler_31bf3856ad364e35_10.0.19041.153_none_c0c4ee134c2535a0\f\DTUHandler.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-complus-ui_31bf3856ad364e35_10.0.19041.1_none_6698d138e79617d9\dcomcnfg.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-mbr2gpt_31bf3856ad364e35_10.0.19041.84_none_ee550b91ec0a7e82\f\MBR2GPT.EXE- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ystemassessmenttool_31bf3856ad364e35_10.0.19041.207_none_59ba79211607f58f\WinSAT.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wordpad_31bf3856ad364e35_10.0.19041.1_none_ee00310940a3cd37\wordpad.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..lity-eoaexperiences_31bf3856ad364e35_10.0.19041.746_none_c291aefd01a5d6d6\f\EoAExperiences.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..riseclientsync-host_31bf3856ad364e35_10.0.19041.1202_none_42d3a7d52bcb0f8d\WorkFolders.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.19041.746_none_3d198a3dbf54d1b4\cmstp.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_220320d2c4216035\poqexec.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-unifiedwritefilter_31bf3856ad364e35_10.0.19041.1_none_522bacd027283125\UwfServicingShell.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager_31bf3856ad364e35_10.0.19041.84_none_ffbdc333a0778274\hvsimgr.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-narrator_31bf3856ad364e35_10.0.19041.84_none_b5c0f628d1d661eb\r\Narrator.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..tegrity-diagnostics_31bf3856ad364e35_10.0.19041.985_none_4a26c2c5164ad5c7\f\CIDiag.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..alcontrols.appxmain_31bf3856ad364e35_10.0.19041.1266_none_1833f07ce0c90b68\r\WpcUapApp.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ces-backgroundagent_31bf3856ad364e35_10.0.19041.423_none_d8a242bf396f7d4d\f\SpaceAgent.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.19041.1266_none_cfec8db821d83671\f\winload.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..rity-spp-validation_31bf3856ad364e35_10.0.19041.1_none_d0dbd55ec26928c1\GenValObj.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemrestore-main_31bf3856ad364e35_10.0.19041.746_none_24d91ab4120e42ee\rstrui.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-choice_31bf3856ad364e35_10.0.19041.1_none_83aca2e25f8134a1\choice.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-corruptedfilerecovery_31bf3856ad364e35_10.0.19041.1_none_3daac563c824d4e0\cofire.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..andlinepropertytool_31bf3856ad364e35_10.0.19041.844_none_e9349b06dfab6fdc\imjpuexc.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..microsoftedgebchost_31bf3856ad364e35_10.0.19041.1_none_14b1d8fa41ae50fb\MicrosoftEdgeBCHost.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_9aa166e99861c2bc\qappsrv.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-uso-dtuhandler_31bf3856ad364e35_10.0.19041.153_none_c0c4ee134c2535a0\r\DTUHandler.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ebviewhost.appxmain_31bf3856ad364e35_10.0.19041.746_none_e873f3aa792d8bb3\f\Win32WebViewHost.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-provisioning-core_31bf3856ad364e35_10.0.19041.844_none_95c651508e565d13\f\provtool.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sethc_31bf3856ad364e35_10.0.19041.746_none_40b989c5d3ea9316\r\EaseOfAccessDialog.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.19041.1266_none_5fd6523a3130632d\ResetEngine.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_10.0.19041.1237_none_556ba5d1df8130ac\f\printui.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-setup-support_31bf3856ad364e35_11.0.19041.1081_none_7e66aef13d0cb227\ie4ushowIE.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-international-unattend_31bf3856ad364e35_10.0.19041.906_none_9e3e509d4c4881e1\f\MuiUnattend.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-scripting_31bf3856ad364e35_10.0.19041.264_none_2649f3f85f3b49b1\wscript.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.19041.264_none_64b3f487e354744d\r\MoUsoCoreWorker.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-x..jectdialog.appxmain_31bf3856ad364e35_10.0.19041.423_none_d93ee361fbbc8f0a\f\XGpuEjectDialog.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bcdboot-cmdlinetool_31bf3856ad364e35_10.0.19041.1_none_1746f218dd81ed09\bcdboot.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ing-management-core_31bf3856ad364e35_10.0.19041.746_none_092d70d1898e5ff9\r\DismHost.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wusa_31bf3856ad364e35_10.0.19041.1151_none_2c2550df02273de3\wusa.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..eldebugger-recorder_31bf3856ad364e35_10.0.19041.746_none_4cb1ff2aa122b5dd\f\tttracer.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.19041.1202_none_dfaaff89afe4f3d4\r\vdsldr.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.19041.1288_none_3f2d1be96237886e\WSManHTTPConfig.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.1_none_6f451098bef6266e\mofcomp.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_49716c2392052aca\r\diskperf.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3940
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 12.9MB
- SHA256 394e24edade0c45826ca12f3b92c6ac6f86fef57558c66ba91564fcb6a2afb57
- MD5 bec9962f17a1061e3b683bb0feb38c49
- SHA1 fc8e9fec2978f6a632712f6227ed667caae3a1aa
- SHA512 8c1daf38ed1f58700f3d226b6db1a77208b39cead0001c0f8dd16a32c7b0c1ffcd075efde88a4bf0172b15c3a46be96a2e4d6cde43a1c912ef26c13d47bc79f2
- SSDEEP 196608:Tpdyn8OyJgV9z8bdsosEU8IBtz/WyZ/K0ttYVAATm60Jojon:FdyndVosEU8IBJuyZ/K0ttYZThxMn
- TLSH T13FD69E13F2A442B5D0B7C178CAA29222EB717C5547B196CF2294B7E81F73AD06F39721
- MD5 SHA1 SHA512 SSDEEP TLSH