Analysis
- max time kernel
150s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 06:25
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe
- Size 14.4MB
- Sample260809-g6xtsaap9x
- SHA256 bb9ba2d26d074b65311c4ee572ee13561c8ce121fd2a5d74510680ca4f0dcf2a
- MD5 df5c6feb6042b9314c02c9015fd08cd1
- SHA1 6a20b999efa24f3e93a94d38f91b26343e7e0d24
- SHA512 4bd6d49aa7a8974b3f61bdd4de540cb5ff4a275965333294114cf445ac1a40ef49802f71da8d793f9bc8c7689731500edb905fefef73dc643e38ec898eda57d6
- SSDEEP 196608:8pdyn8OyJgV9z8bdsosEU8IBtz/WyZ/K0ttYVAATm6qTfRo6:OdyndVosEU8IBJuyZ/K0ttYZThOW6
- TLSH T143E6AE13F2E401B5E0AAD27DC9714632D7717C2A4BB193CF2250B6E91E73BD16A39722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral2/files/0x000d00000001c4db-4.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral2/files/0x000d00000001c4db-4.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule behavioral2/files/0x000d00000001c4db-4.dat UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\dfrgui.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\dllhost.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\DWWIN.EXE 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\gpupdate.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\Netplwiz.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\chkdsk.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\GamePanel.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\makecab.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\PkgMgr.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\Taskmgr.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\mountvol.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\MuiUnattend.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\netiougc.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\ntprint.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\odbcad32.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\replace.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\shutdown.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\tcmsetup.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\msinfo32.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\openfiles.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\typeperf.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\unregmp2.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\wermgr.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\Windows.WARP.JITService.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\certutil.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\gpresult.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\NETSTAT.EXE 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\taskkill.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\TpmTool.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\instnm.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\iscsicli.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\mmc.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\RdpSa.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\setup16.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\attrib.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\comp.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\netsh.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\proquota.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\tzutil.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\mmgaserver.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\SecEdit.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\netbtugc.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\resmon.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\wscadminui.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\ByteCodeGenerator.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\dplaysvr.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\mshta.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\odbcconf.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\PresentationHost.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\sort.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\whoami.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\wscript.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre-1.8\bin\jjs.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Windows Defender\MsMpEng.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Windows Media Player\setup_wm.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Windows Defender\MpDefenderCoreService.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\7-Zip\Uninstall.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Windows Defender\DlpUserAgent.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Windows Mail\wabmig.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Internet Explorer\ieinstal.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Windows Media Player\wmplayer.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\uninstall.cmd- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\wow64_microsoft-windows-d..omerfeedbackmanager_31bf3856ad364e35_10.0.26100.1591_none_824861107299001b\r\imecfmui.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SystemApps\NcsiUwpApp_8wekyb3d8bbwe\NcsiUwpApp.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-iexpress_31bf3856ad364e35_11.0.26100.1150_none_441b414b1810724c\wextract.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_10.0.26100.1591_none_8feeb08b8bdf7ddb\regedt32.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..line-user-interface_31bf3856ad364e35_10.0.26100.1150_none_78cec33b8cc1ebd0\cmdkey.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_userexperience-lkg_31bf3856ad364e35_10.0.26100.1742_none_3c72368675eae921\LKG.Search\FESearchHost.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.26100.1455_none_b184dc3c337d380b\r\wmpshare.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regiis.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regsql.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.26100.1591_none_4ef9c76ea26d9c67\mavinject.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.26100.1301_none_22d8cfb46252dd83\HvsiSettingsWorker.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.26100.1_none_a518656df7c165fb\SenseTVM.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-audio-volumecontrol_31bf3856ad364e35_10.0.26100.1591_none_6c3d16dfebe198e3\r\SndVol.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SystemApps\LKG\MicrosoftWindows.LKG.Search_cw5n1h2txyewy\FESearchHost.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..dateclient-api-host_31bf3856ad364e35_10.0.26100.1_none_9cc92cd303f82ace\wuapihost.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_compiler.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_windows-defender-service_31bf3856ad364e35_10.0.26100.1_none_c299cb2ebf592e77\MpDefenderCoreService.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\x86_netfx4-ilasm_exe_b03f5f7f11d50a3a_4.0.15912.146_none_9f891aedaabbca5a\ilasm.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_netfx-dw_b03f5f7f11d50a3a_10.0.26100.1_none_2a2ee039ba45ffa6\dw20.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_windows-defender-service_31bf3856ad364e35_10.0.26100.1_none_c299cb2ebf592e77\MpDlpCmd.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\msil_servicemodelreg_b03f5f7f11d50a3a_10.0.26100.1_none_ef0c64fcaf8f69dc\ServiceModelReg.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_multimedia-rrinstaller_31bf3856ad364e35_10.0.26100.1_none_1a35ff092a421b8f\rrinstaller.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-capturepicker.appxmain_31bf3856ad364e35_10.0.26100.1591_none_d07e775d9a3de1d6\r\CapturePicker.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..rvices-adam-install_31bf3856ad364e35_10.0.26100.1150_none_b8bbaaa483060b58\adaminstall.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..-remoteapplications_31bf3856ad364e35_10.0.26100.1591_none_ddd035314c6868c8\r\rdpinit.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.26100.1150_none_8097a9dca8ee24c4\qappsrv.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-atbroker_31bf3856ad364e35_10.0.26100.1591_none_75b5554a02bcd133\r\AtBroker.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..eapplifetimemanager_31bf3856ad364e35_10.0.26100.1591_none_02ccdf13e86dfcfe\r\RemoteAppLifetimeManager.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-previewhost_31bf3856ad364e35_10.0.26100.1150_none_df24b599b0c88e62\prevhost.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-snippingtool-app_31bf3856ad364e35_10.0.26100.1150_none_35ab52a6398cdc65\r\SnippingTool.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..structureexecutable_31bf3856ad364e35_10.0.26100.1591_none_9e1d25f83a6fdbc2\unlodctr.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\x86_netfx4-csc_exe_b03f5f7f11d50a3a_4.0.15912.338_none_b6935413ba17b58c\csc.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-commandprompt_31bf3856ad364e35_10.0.26100.1591_none_26ccc1e3ca6360b3\cmd.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-speech-userexperience_31bf3856ad364e35_10.0.26100.1591_none_b7c9eb31fbd37700\r\SpeechUXWiz.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_ce938c0efedcde06\r\HOSTNAME.EXE- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\r\CBS\WindowsBackupClient.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-taskkill_31bf3856ad364e35_10.0.26100.1_none_2cc651b7f8fde87f\taskkill.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ldifde_31bf3856ad364e35_10.0.26100.1150_none_bcce913ab8bc643d\ldifde.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.26100.1150_none_36fd183d90da21cb\r\immersivetpmvscmgrsvr.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_wpf-presentationhostexe_31bf3856ad364e35_10.0.26100.1150_none_0bdb83c7d007c6bc\r\PresentationHost.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\csc.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Ldr64.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-admincmdtools_31bf3856ad364e35_10.0.26100.1150_none_50956d2d42f20d39\r\nfsadmin.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-utilman_31bf3856ad364e35_10.0.26100.1591_none_9e69ab15e1442616\Utilman.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-containerdiagnosticstool_31bf3856ad364e35_10.0.26100.1150_none_234860e0e753c908\hcsdiag.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-extrac32_31bf3856ad364e35_10.0.26100.1150_none_7710eb15b3cf4c31\extrac32.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rundll32_31bf3856ad364e35_10.0.26100.1591_none_7e19f7088f522c23\rundll32.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\x86_netfx-csharp_compiler_csc_b03f5f7f11d50a3a_10.0.26100.1_none_a2b84bade0a375ce\csc.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-complus-setup_31bf3856ad364e35_10.0.26100.1150_none_858f29bf9f3816d2\mtstocom.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..n-tools-command-ldp_31bf3856ad364e35_10.0.26100.1150_none_eb28a122b02acd12\r\ldp.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mdmagent_31bf3856ad364e35_10.0.26100.1591_none_e0bca845ce26528b\MDMAgent.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasautodial_31bf3856ad364e35_10.0.26100.1150_none_abc14f2d153d07e6\rasautou.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-scripting_31bf3856ad364e35_10.0.26100.1591_none_e4284e3cb060c8bf\r\wscript.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-calc_31bf3856ad364e35_10.0.26100.1_none_a6b1a99b83489282\calc.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cipher_31bf3856ad364e35_10.0.26100.1150_none_48fdcfd155028bbe\cipher.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-commandprompt_31bf3856ad364e35_10.0.26100.1591_none_31216c35fec422ae\cmd.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-externaldictionary_31bf3856ad364e35_10.0.26100.1591_none_e2b02f289d06cfcc\r\IMEWDBLD.EXE- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-getmac_31bf3856ad364e35_10.0.26100.1_none_1346e96d3ee86ee9\getmac.exe- 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_df5c6feb6042b9314c02c9015fd08cd1_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4316
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 15.3MB
- SHA256 553cd40665f7694f0dafd15b9c8a16d8b1e740cb844e490fca2a3e816e3d8fbe
- MD5 090b49ebd6ae9cbddfa54e18d548a17a
- SHA1 426db08c6b7658fea242af8da5a9be99ecff8772
- SHA512 d821904f84e5454aa6cea893e1715703448cdf1b89492aa38c715eb39ffe468771f0c72b89ed5c2b3d30aebfe20c000c9e01aaca33509809eea4903f7d8c7ed3
- SSDEEP 196608:8pdyn8OyJgV9z8bdsosEU8IBtz/WyZ/K0ttYVAATm6qTfRo4A:OdyndVosEU8IBJuyZ/K0ttYZThOW1
- TLSH T10BF6AE13F2E402B6E0B6D179C5725636EB717C1A4B7183CF2244B6E81E73BD16A39722
- MD5 SHA1 SHA512 SSDEEP TLSH