Analysis
- max time kernel
149s - max time network
133s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/08/2026, 06:25
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe
- Size 14.4MB
- Sample260809-g6xtsaap9x
- SHA256 bb9ba2d26d074b65311c4ee572ee13561c8ce121fd2a5d74510680ca4f0dcf2a
- MD5 df5c6feb6042b9314c02c9015fd08cd1
- SHA1 6a20b999efa24f3e93a94d38f91b26343e7e0d24
- SHA512 4bd6d49aa7a8974b3f61bdd4de540cb5ff4a275965333294114cf445ac1a40ef49802f71da8d793f9bc8c7689731500edb905fefef73dc643e38ec898eda57d6
- SSDEEP 196608:8pdyn8OyJgV9z8bdsosEU8IBtz/WyZ/K0ttYVAATm6qTfRo6:OdyndVosEU8IBJuyZ/K0ttYZThOW6
- TLSH T143E6AE13F2E401B5E0AAD27DC9714632D7717C2A4BB193CF2250B6E91E73BD16A39722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral1/files/0x000a00000002425b-4.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral1/files/0x000a00000002425b-4.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule behavioral1/files/0x000a00000002425b-4.dat UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\ARP.EXE- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\cacls.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\OneDriveSetup.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\CheckNetIsolation.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\compact.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\dxdiag.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\fixmapi.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\makecab.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\cmd.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\DpiScaling.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\mmgaserver.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\wevtutil.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\ipconfig.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\poqexec.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\format.com- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\LaunchTM.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\Netplwiz.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\PkgMgr.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\raserver.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\Dism.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\ftp.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\grpconv.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\rasphone.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\RmClient.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\Robocopy.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\w32tm.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\waitfor.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\dplaysvr.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\netiougc.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\RpcPing.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\TRACERT.EXE 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\unregmp2.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\cmmon32.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\colorcpl.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\Dism.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\find.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\SecEdit.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\setupugc.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\takeown.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\MuiUnattend.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\systeminfo.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\userinit.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\wscadminui.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\WWAHost.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\ByteCodeGenerator.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\CloudNotifications.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\cmdl32.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\GamePanel.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\OpenWith.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\sfc.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\UnlockApprove.bat 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Windows Media Player\wmpshare.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Windows Media Player\wmplayer.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Windows Mail\wab.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Windows Media Player\setup_wm.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Mozilla Firefox\firefox.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\IEExec.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1_none_bf506ecc66a800df\TiFileFetcher.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ices-appcompattools_31bf3856ad364e35_10.0.19041.1_none_a9109d150b1bf064\CHKROOT.CMD- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-f..temcompareutilities_31bf3856ad364e35_10.0.19041.1_none_c10c5c59091a9a90\comp.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.19041.153_none_ff44cfa7cb529ce3\f\lpksetup.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wslhost_31bf3856ad364e35_10.0.19041.1151_none_329784a84ed43acd\f\wslhost.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-explorer_31bf3856ad364e35_10.0.19041.1266_none_d0cf24ea634e86e3\r\explorer.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msaudittools_31bf3856ad364e35_10.0.19041.546_none_ffd303094ff1fe66\f\auditpol.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\x86_caspol_b03f5f7f11d50a3a_10.0.19041.1_none_2cbf497a80df4629\CasPol.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ed-chinese-moimeexe_31bf3856ad364e35_10.0.19041.746_none_c3054a007d804943\r\ChsIME.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager_31bf3856ad364e35_10.0.19041.84_none_ffbdc333a0778274\hvsirdpclient.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..nt-enrollmenthelper_31bf3856ad364e35_10.0.19041.746_none_18c3ddf7dbfedda0\r\PinEnrollmentBroker.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ie-iexpress_31bf3856ad364e35_11.0.19041.1_none_f23fc9b9908be4fc\wextract.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-c..periencehost-broker_31bf3856ad364e35_10.0.19041.746_none_1ce3c0f12fb5f8ec\f\CloudExperienceHostBroker.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.1_none_6f451098bef6266e\unsecapp.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_wcf-wsatconfig_b03f5f7f11d50a3a_10.0.19041.1_none_c45aa783f860ee61\WsatConfig.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-terminalservices-theme_31bf3856ad364e35_10.0.19041.746_none_be3404fb0dff5d84\f\TSTheme.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-coredpussvr_31bf3856ad364e35_10.0.19041.746_none_7946fb11bf19dc87\coredpussvr.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pktmon-setup_31bf3856ad364e35_10.0.19041.928_none_31fd477afc7b8278\r\PktMon.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.19041.1_none_fad1fa0072ef4a3a\IMEPADSV.EXE- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mapi_31bf3856ad364e35_10.0.19041.423_none_93adcfb5ace23a89\r\fixmapi.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SystemApps\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\CHXSmartScreen.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-e..taprotectioncleanup_31bf3856ad364e35_10.0.19041.789_none_b38221af158e5881\EDPCleanup.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-parentalcontrols-ots_31bf3856ad364e35_10.0.19041.84_none_8a067925a612632c\ApproveChildRequest.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_multipoint-wmssessionagent_31bf3856ad364e35_10.0.19041.746_none_7f157730d01dcdae\r\WmsSessionAgent.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-charmap_31bf3856ad364e35_10.0.19041.1_none_a84acae243b8ad63\charmap.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-grouppolicy-script_31bf3856ad364e35_10.0.19041.572_none_42ec0e96ce977bdb\f\gpscript.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_netfx4-aspnet_state_exe_b03f5f7f11d50a3a_4.0.15805.0_none_5ffcb7ce21b4d707\aspnet_state.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..l-systemuwplauncher_31bf3856ad364e35_10.0.19041.746_none_ed5986fc58f1b817\r\SystemUWPLauncher.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-htmlhelp_31bf3856ad364e35_10.0.19041.746_none_b0a3ebd117ec81d4\hh.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-scripting_31bf3856ad364e35_10.0.19041.1237_none_c77fb947e9eed73b\f\wscript.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager_31bf3856ad364e35_10.0.19041.84_none_ffbdc333a0778274\f\hvsimgr.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..usnotificationuxexe_31bf3856ad364e35_10.0.19041.1266_none_e8d910c7c702b558\r\MusNotificationUx.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\Temp\PendingDeletes\ace9914536e5d7010a9b00001815341f.WMSvc.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_10.0.19041.1110_none_0565d41cd46ec20a\msinfo32.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SystemApps\Microsoft.AsyncTextService_8wekyb3d8bbwe\Microsoft.AsyncTextService.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.19041.1_none_0bc0f3d4cd7dc8fd\CExecSvc.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-assignedaccess-guard_31bf3856ad364e35_10.0.19041.844_none_10a0a60f1ec9cc10\n\AssignedAccessGuard.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.19041.906_none_198d8d483aa30ed0\r\gpresult.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.1_none_171488549e32a4d3\relog.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sctasks_31bf3856ad364e35_10.0.19041.906_none_686405dc140529cf\f\schtasks.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sethc_31bf3856ad364e35_10.0.19041.1_none_2305f6cf48d996c7\EaseOfAccessDialog.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.19041.1_none_f15a0c837b51c5fc\gpupdate.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.19041.1151_none_fbdc4c5f677dc2ec\r\HvsiSettingsWorker.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.19041.264_none_1477a882bdce0df2\vmms.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..cation-creduibroker_31bf3856ad364e35_10.0.19041.746_none_a8b46aaa6c07ca3d\f\CredentialUIBroker.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-control_31bf3856ad364e35_10.0.19041.423_none_7777dd52093f9dd6\f\control.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-adamsync_31bf3856ad364e35_10.0.19041.1081_none_6700b2d2d3c0055f\adamsync.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-b..nfrastructurebghost_31bf3856ad364e35_10.0.19041.1_none_313898283cd914f7\backgroundTaskHost.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.264_none_583d67d6d00b6b6a\WerFault.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..llshield-wow64-main_31bf3856ad364e35_10.0.19041.1081_none_e34aea343fc255b7\setup.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lishing-wmiprovider_31bf3856ad364e35_10.0.19041.1151_none_aa086da848b2c07b\r\rdpsign.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\Temp\PendingDeletes\9714214736e5d7015ba100001815341f.adamsync.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-robocopy_31bf3856ad364e35_10.0.19041.1266_none_4621ad58d5f654dd\r\Robocopy.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-aarsvc_31bf3856ad364e35_10.0.19041.1266_none_d7b5820f5a89765b\r\agentactivationruntimestarter.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-help-client_31bf3856ad364e35_10.0.19041.1151_none_e0e8a531e34051a9\HelpPane.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:536
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 14.9MB
- SHA256 2734de8fe46fbdb3128a81a2946d580928304bfe818f3d36cd3a80e204401c0d
- MD5 6816bf8eb06926b5559043fc3649e49f
- SHA1 9bdadf2b10282eeb2f29e44a8691f007d6b86670
- SHA512 65fdb9a7f04bb8a4cd29f4246543208644dfdab9dfedf7a18da439cbc9b4df290e7e5b6b032f1d247ea7f84beccdf620134e092c3e93287a295b4bf47add8045
- SSDEEP 196608:8pdyn8OyJgV9z8bdsosEU8IBtz/WyZ/K0ttYVAATm6qTfRoQou:OdyndVosEU8IBJuyZ/K0ttYZThOWvu
- TLSH T1E6F6AE13F2E401B5E0B6D17DC9714626E7717C2A4BB183CF2254B6E91E73BD16A3A322
- MD5 SHA1 SHA512 SSDEEP TLSH