Analysis
- max time kernel
149s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
06/08/2026, 22:39
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe
- Size 7.0MB
- Sample260806-2lespasbmd
- SHA256 83133e212e37bf645bb47bb7e9a894e882b9216711907a53dafd90534085a013
- MD5 bf7c9304fb22929caa2c58a425f6ba72
- SHA1 3ec106047d55e6f464d178cc409d31ee0762a5f1
- SHA512 f949a4be9b18f7a6de7839f3bac05a7a49cff094aa2949070d2ac51d6d6f1a95e36be91fb01b591d589d7327230e296cabaf2a5c61210fa51b954595bd4af58d
- SSDEEP 49152:Dx4fD2eW4SkZP4sz9MbAjk8x1T4sE21lu72I3t4lY6+/Y4O8b8ITDnlmg4vT3S9y:7fkZcAjkolXXu/3NETIOSA5fkZct
- TLSH T1D4763A1272E8C2A7E0755175CCA57BB965603C399B22CECB7D04BA1A79327C2853373E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral1/files/0x000500000001690d-4.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral1/files/0x000500000001690d-4.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\sort.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\systeminfo.exe 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\w32tm.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\credwiz.exe 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\dialer.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\fontdrvhost.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\mobsync.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\newdev.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\sfc.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\wiaacmgr.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\CloudNotifications.exe 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\compact.exe 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\raserver.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\regsvr32.exe 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\sxstrace.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\attrib.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\charmap.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\ARP.EXE 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\dllhost.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\Fondue.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\stordiag.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\SystemUWPLauncher.exe 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\wlanext.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\hdwwiz.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\ipconfig.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\iscsicli.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\netbtugc.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\TpmTool.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\clip.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\cscript.exe 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\extrac32.exe 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\label.exe 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\icsunattend.exe 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\netsh.exe 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\fltMC.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\rasautou.exe 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\wevtutil.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\Com\comrepl.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\edpnotify.exe 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\mspaint.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\systray.exe 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\whoami.exe 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\mstsc.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\esentutl.exe 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\Fondue.exe 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\ftp.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\scrnsave.scr 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\quickassist.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\rasdial.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\getmac.exe 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\AtBroker.exe 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\bootcfg.exe 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\mountvol.exe 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\TapiUnattend.exe 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Program Files\StopEnter.cmd 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\show_third_party_software_licenses.bat 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Program Files\StopEnter.cmd- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Program Files\Windows Media Player\wmprph.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Program Files\7-Zip\7zFM.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework\v3.5\MSBuild.exe 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_9aa166e99861c2bc\qprocess.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dfsvc.exe 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..cation-creduibroker_31bf3856ad364e35_10.0.19041.746_none_a8b46aaa6c07ca3d\r\CredentialUIBroker.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvsystem_31bf3856ad364e35_10.0.19041.1081_none_bdf809eb2dd695f9\f\AppVClient.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..cecontroller-minwin_31bf3856ad364e35_10.0.19041.1_none_f509d2f29c00c5f0\services.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_10.0.19041.1_none_03cd5b18c0751679\mstsc.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.19041.1_none_8aab2d3580c614cb\winrm.cmd- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_1.0.19041.1_none_598949f46770a8b9\dplaysvr.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devicecensus_31bf3856ad364e35_10.0.19041.1202_none_24329c73afbd2316\r\DeviceCensus.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ces-backgroundagent_31bf3856ad364e35_10.0.19041.423_none_d8a242bf396f7d4d\r\SpaceAgent.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wimgapi_31bf3856ad364e35_10.0.19041.84_none_809ebfa242fbf368\r\wimserv.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\ScriptRunner.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..alcontrols.appxmain_31bf3856ad364e35_10.0.19041.1266_none_1833f07ce0c90b68\WpcUapApp.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wordpad_31bf3856ad364e35_10.0.19041.1_none_e3ab86b70c430b3c\wordpad.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\r\AppVShNotify.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.19041.1266_none_fb76f6fb7e78a373\InputApp\TextInputHost.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_caspol_b03f5f7f11d50a3a_10.0.19041.1_none_e51212a36c631d23\CasPol.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.19041.906_none_198d8d483aa30ed0\gpupdate.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mdmappinstaller_31bf3856ad364e35_10.0.19041.844_none_77a5d9aafae08e77\r\MDMAppInstaller.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.19041.1266_none_fb98272b39a47240\MoUsoCoreWorker.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_security-octagon-broker_31bf3856ad364e35_10.0.19041.546_none_380485edeba9f4c4\r\SgrmBroker.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mapi-mmga_31bf3856ad364e35_10.0.19041.746_none_be98bb8265bc211a\f\mmgaserver.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_a4f6113bccc284b7\qprocess.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.19041.746_none_770f598aef14382e\dfrgui.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dxp-deviceexperience_31bf3856ad364e35_10.0.19041.746_none_251e769058968366\f\Dxpserver.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..tnet-mua-hostserver_31bf3856ad364e35_10.0.19041.746_none_aee92417063babbe\f\WinRTNetMUAHostServer.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-commandprompt_31bf3856ad364e35_10.0.19041.1_none_4b527e92ee1ad1e5\cmd.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-embedded-shelllauncher_31bf3856ad364e35_10.0.19041.264_none_223a5768a6257099\f\CustomShellHost.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.19041.1202_none_8f7e37524c3e1a13\SystemSettings.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-starttiledata_31bf3856ad364e35_10.0.19041.1202_none_05856bbd8f935e6b\r\DataStoreCacheDumpTool.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..tnet-mua-hostserver_31bf3856ad364e35_10.0.19041.746_none_aee92417063babbe\WinRTNetMUAHostServer.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sethc_31bf3856ad364e35_10.0.19041.746_none_4b0e3418084b5511\r\sethc.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-x..rtificateenrollment_31bf3856ad364e35_10.0.19041.746_none_dbe4ac1121d6e6d7\r\CertEnrollCtrl.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..s-datausagehandlers_31bf3856ad364e35_10.0.19041.746_none_dbecc8a3cdc7c3cf\DataUsageLiveTileTask.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\wow64_msbuild_b03f5f7f11d50a3a_4.0.15805.0_none_0606cd4b5dabfc56\MSBuild.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.19041.1_none_51facbaf4051768b\resmon.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..sistance-dcomserver_31bf3856ad364e35_10.0.19041.1110_none_a4bfcaa32abfcf0e\raserver.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux_31bf3856ad364e35_10.0.19041.1202_none_d081cba554088913\f\slui.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.19041.1266_none_5fd6523a3130632d\systemreset.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.19041.1151_none_f68db62a3702882b\f\SearchFilterHost.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appidcore_31bf3856ad364e35_10.0.19041.1202_none_a391067a6b9b433c\f\appidtel.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.19041.1266_none_fb76f6fb7e78a373\ScreenClipping\ScreenClippingHost.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-aarsvc_31bf3856ad364e35_10.0.19041.1266_none_e20a2c618eea3856\r\agentactivationruntimestarter.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-newdev_31bf3856ad364e35_10.0.19041.1202_none_908b22903a403149\f\ndadmin.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-guestcomputeservice_31bf3856ad364e35_10.0.19041.1202_none_024525bdc81df50d\VmComputeAgent.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\f\AppVStreamingUX.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eventlog-commandline_31bf3856ad364e35_10.0.19041.1202_none_3594628932065f23\wevtutil.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-iexpress_31bf3856ad364e35_11.0.19041.1_none_4e5e653d48e95632\wextract.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-onlinesetup-component_31bf3856ad364e35_10.0.19041.1_none_23025624c75c162f\windeploy.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_9aa166e99861c2bc\change.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-thumbexthost_31bf3856ad364e35_10.0.19041.746_none_ce6643a69c39f80a\ThumbnailExtractionHost.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wmi-core-providerhost_31bf3856ad364e35_10.0.19041.546_none_f8b0afde1e951639\WmiPrvSE.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shellhost_31bf3856ad364e35_10.0.19041.746_none_f47187f881cbaf7d\f\sihost.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_10.0.19041.1_none_4ac6500cab2b2113\SystemPropertiesRemote.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-tetheringservice_31bf3856ad364e35_10.0.19041.746_none_6ba9668b45cb4938\f\IcsEntitlementHost.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bootux.deployment_31bf3856ad364e35_10.0.19041.746_none_1c0a97992f105d4b\f\bootim.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-proximityuxhost_31bf3856ad364e35_10.0.19041.1_none_4aeccdccebca6ca1\ProximityUxHost.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-settingsynchost_31bf3856ad364e35_10.0.19041.1202_none_f4a35974d85ff180\f\SettingSyncHost.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..snotificationbroker_31bf3856ad364e35_10.0.19041.1266_none_d92abf553d8a282c\f\MusNotification.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_windows-shield-provider_31bf3856ad364e35_10.0.19041.1266_none_1abb9653828c3f41\SecurityHealthHost.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-eventcollector_31bf3856ad364e35_10.0.19041.662_none_e341f52007f6d1a8\f\wecutil.exe- 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-06_bf7c9304fb22929caa2c58a425f6ba72_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5044
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 7.5MB
- SHA256 ad834d145658e83890e508d5f0910d5c4d3f2a45f161fb261bf7fd8485f0ec60
- MD5 46d120710ac9ba898b5d519c3f3a9da9
- SHA1 f2a3ddb11e4564443582cb28b21a370f8c5d1120
- SHA512 719a886d828def5831165f74b77449b230b57379314f9da593f5f0bd3da9f28076ce84ab0a084764e3c740b9f6dbc750ad83caf054e09a4363a26ec9f9165dc1
- SSDEEP 49152:Dx4fD2eW4SkZP4sz9MbAjk8x1T4sE21lu72I3t4lY6+/Y4O8b8ITDnlmg4vT3S9f:7fkZcAjkolXXu/3NETIOSA5fkZcJjoP
- TLSH T1E6862916B2E8C2A7E0755175CCA57AB9A5303C299B31CECB7D04BA1979327C2853373E
- MD5 SHA1 SHA512 SSDEEP TLSH