Analysis
- max time kernel
150s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 11:28
Behavioral task
behavioral1
Sample
2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe
- Size 12.4MB
- Sample260804-nlcrfaac95
- SHA256 8a17686dbab9e92eea477c5b8f3d1f2b79533a5dfb8eef098af19d7717bad823
- MD5 6c91c30e3c154c69b5f347371eed692d
- SHA1 e5372e7493e9b43b46e933e15d54c5ccfcedcda6
- SHA512 16c1f4c2a9990def3b64dbe9b77a62694a34ce036e666870cd324cb8b095ee17ea876d1e0e83b4442e45e08c009708103a3397a705320eae5399df4b9d0af26e
- SSDEEP 196608:Tpdyn8OyJgV9z8bdsosEU8IBtz/WyZ/K0ttYVAATm60Jo3:FdyndVosEU8IBJuyZ/K0ttYZThx3
- TLSH T165D69E13F2A402F5D0B7D178CA629222EB727C5547B196CF2294B6E81F73AD06F39721
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule behavioral2/files/0x000a00000001b1b7-5.dat UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\autofstx.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\odbcad32.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\tcmsetup.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\tcmsetup.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\timeout.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\wermgr.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\wowreg32.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\subst.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\typeperf.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\WerFault.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\dfrgui.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\edpnotify.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\notepad.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\chkntfs.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\Fondue.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\fontview.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\icsunattend.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\more.com- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\netsh.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\scrnsave.scr- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\Com\comrepl.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\doskey.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\recover.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\makecab.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\netbtugc.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\TRACERT.EXE- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\wusa.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\certutil.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\convert.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\fsquirt.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\mobsync.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\unlodctr.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\Windows.WARP.JITService.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\winrshost.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\AtBroker.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\OposHost.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\sdchange.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\TpmInit.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\win32calc.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\icacls.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\Magnify.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\Netplwiz.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\attrib.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\colorcpl.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\mfpmp.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\proquota.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\bitsadmin.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\comp.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\dplaysvr.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\hdwwiz.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\runas.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe -
resource yara_rule behavioral2/memory/2400-0-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/files/0x000a00000001b1b7-5.dat upx behavioral2/memory/2400-380-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2400-381-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2400-737-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2400-1070-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2400-1450-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2400-1649-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2400-2036-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2400-2374-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2400-2723-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2400-2920-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2400-2921-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2400-2922-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2400-2923-0x0000000000400000-0x000000000040F000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\7-Zip\7zFM.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Windows Defender\MpDlpCmd.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Windows Media Player\setup_wm.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Windows Media Player\setup_wm.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Windows Media Player\wmpshare.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{ECFE93F7-0E0D-49A5-A40C-A888E035F269}\MicrosoftEdge_X64_139.0.3405.125.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Windows Defender\DlpUserAgent.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.26100.1591_none_bd195c301c7f4e60\r\lpksetup.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1150_none_553b538bcf828876\mofcomp.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-xcopy_31bf3856ad364e35_10.0.26100.1_none_5fe953095cd8da00\xcopy.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ilasm.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..-disposableclientvm_31bf3856ad364e35_10.0.26100.1591_none_815687268bc7e515\r\WindowsSandbox.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-takeown_31bf3856ad364e35_10.0.26100.1_none_f6df0e2a7e2ab480\takeown.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..tegrity-diagnostics_31bf3856ad364e35_10.0.26100.1_none_694d5c871fe6dacc\CIDiag.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-synchost_31bf3856ad364e35_10.0.26100.1150_none_05685d8fac7c4f66\SyncHost.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_8465405a0441f0fb\doskey.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.26100.1_none_686bcd839bc27ad8\logman.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-compact_31bf3856ad364e35_10.0.26100.1_none_013d8d7d527fe5d5\compact.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-grpconv_31bf3856ad364e35_10.0.26100.1_none_a9d07790da9b357f\grpconv.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-runtimebroker_31bf3856ad364e35_10.0.26100.1591_none_321363d9581bd94b\r\RuntimeBroker.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-efs-rekeywiz_31bf3856ad364e35_10.0.26100.1150_none_a3d1faf3bbc1c7d8\r\rekeywiz.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-ielowutil_31bf3856ad364e35_11.0.26100.1150_none_e61570904a993a97\r\ielowutil.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-migrationengine_31bf3856ad364e35_10.0.26100.1591_none_f467d2d98b46d418\r\mighost.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.26100.1150_none_3a3e93ee89e96c57\changepk.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..-commandline-dsdiag_31bf3856ad364e35_10.0.26100.1_none_ed041165ae384870\dcdiag.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SystemApps\LKG\MicrosoftWindows.LKG.Search_cw5n1h2txyewy\MiniSearchHost.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-autochkconfigurator_31bf3856ad364e35_10.0.26100.1_none_15b623f8f051104d\chkntfs.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-commandline_31bf3856ad364e35_10.0.26100.1150_none_cb65497b42fc406d\r\Dism.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..pectedcodepathtasks_31bf3856ad364e35_10.0.26100.1591_none_99fc5c721ed12b35\r\UCConfigTask.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-pnp-drvinst_31bf3856ad364e35_10.0.26100.1591_none_f11dd8b719f1a6f5\drvinst.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..esslockapp.appxmain_31bf3856ad364e35_10.0.26100.1150_none_d3d5c425d4ba6a5f\AssignedAccessLockApp.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userdeviceregistration_31bf3856ad364e35_10.0.26100.1591_none_b519370a5498ebc4\dsregcmd.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.26100.1150_none_664cc5d65cf1b4d8\wsmprovhost.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iscsi_initiator_ui_31bf3856ad364e35_10.0.26100.1_none_df337d63f8ff3ba4\iscsicpl.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..e-flexible-platform_31bf3856ad364e35_10.0.26100.1591_none_dd61c19e2e413ac5\fclip.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..tional-chinese-core_31bf3856ad364e35_10.0.26100.1591_none_f543f8b3b0fee44f\IMTCLNWZ.EXE- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.26100.1150_none_5404854ee1749b61\shrpubw.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_winappsdk-cbs_31bf3856ad364e35_10.0.26100.1591_none_60aad032a4073cbd\r\DeploymentAgent.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-gaming-ga..rnal-presencewriter_31bf3856ad364e35_10.0.26100.1_none_096f21018ec4c252\GameBarPresenceWriter.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_edmgen_b77a5c561934e089_4.0.15912.0_none_b064199c91afa844\EdmGen.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..-disposableclientvm_31bf3856ad364e35_10.0.26100.1591_none_815687268bc7e515\WindowsSandboxClient.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_10.0.26100.1150_none_723b9016a5d6336f\printui.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eventlog-commandline_31bf3856ad364e35_10.0.26100.1150_none_5cbb86162cb9f00b\wevtutil.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-upfc_31bf3856ad364e35_10.0.26100.1150_none_430cd619cc4d0de3\r\upfc.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regsql.exe 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..ysafety-refreshtask_31bf3856ad364e35_10.0.26100.1591_none_fa6fdcd71655ec4d\r\WpcTok.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-clientcore_31bf3856ad364e35_10.0.26100.1150_none_48c9cd2bf27dfea7\nfsclnt.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-lsatrustlet_31bf3856ad364e35_10.0.26100.1591_none_805965242ec082f4\LsaIso.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet_state_exe_b03f5f7f11d50a3a_10.0.26100.1_none_ddaf5dc661e91ea5\aspnet_state.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_netfx-jsc_b03f5f7f11d50a3a_10.0.26100.1_none_e49f43adae7337af\jsc.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appresolverux.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9ce862b2367e1d00\r\AppResolverUX.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-at_31bf3856ad364e35_10.0.26100.1150_none_e8e8f4e033ce6e38\r\at.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..andlinepropertytool_31bf3856ad364e35_10.0.26100.1150_none_a7249f5f30c44921\imjpuexc.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-netcfg_31bf3856ad364e35_10.0.26100.1150_none_ac162c2f01636f98\r\netcfg.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-provisioning-core_31bf3856ad364e35_10.0.26100.1591_none_538f0058df8c2519\provtool.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-scrnsave_31bf3856ad364e35_10.0.26100.1150_none_7d26f17a8a4ec06a\scrnsave.scr- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-web-app-host_31bf3856ad364e35_10.0.26100.1_none_39d8198a6bf822dd\WWAHost.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winrsplugins_31bf3856ad364e35_10.0.26100.1150_none_b21dc6dde1913832\r\winrshost.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-storage-diagnostics_31bf3856ad364e35_10.0.26100.1591_none_1ac5fa16ecade80d\r\stordiag.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..cecontroller-minwin_31bf3856ad364e35_10.0.26100.1591_none_dad8c095acaa16b9\services.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..acyinkingcomponents_31bf3856ad364e35_10.0.26100.1_none_493a1e7e2682a5b1\pipanel.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..player-shellpreview_31bf3856ad364e35_10.0.26100.1150_none_5c8523a823214933\r\wmprph.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-makecab_31bf3856ad364e35_10.0.26100.1_none_f817d499062c355e\makecab.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-powershell-exe_31bf3856ad364e35_10.0.26100.1_none_6609a7146abf3e09\powershell.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..sistance-dcomserver_31bf3856ad364e35_10.0.26100.1_none_2ce74853de1f47d4\raserver.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ipconfig_31bf3856ad364e35_10.0.26100.1_none_538243b2b4dbfed1\ipconfig.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-regsvr32_31bf3856ad364e35_10.0.26100.1_none_7f9f7003cc70f4b2\regsvr32.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_1.0.26100.1_none_6e96156553a511df\dplaysvr.exe- 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_6c91c30e3c154c69b5f347371eed692d_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2400
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 13.4MB
- SHA256 a6cf4dbe4d466706520529ac85ba0423e0fc915326b139b28a701209ede45fc4
- MD5 187026f6c1f6a29b4a4fa4ce6ef0c909
- SHA1 759161335afdc9e9f61022f44b9def389dfd74a0
- SHA512 8447ed3753b681576eba22c0fc1b2554eb08f3c80b96a38779ae86a271e9faa6997249136d73ffcc2fd96c8e653cef16c35a594d48115842923043d31c9a1b09
- SSDEEP 196608:Tpdyn8OyJgV9z8bdsosEU8IBtz/WyZ/K0ttYVAATm60Joz1:FdyndVosEU8IBJuyZ/K0ttYZThx5
- TLSH T1E2E69E13F2A442B5D0B7D178CAA69322EB727C55477096CF1254B7E82F33AE06B39721
- MD5 SHA1 SHA512 SSDEEP TLSH