Analysis
- max time kernel
150s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 06:38
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe
- Size 14.4MB
- Sample260809-hd4x3aar6s
- SHA256 35ac2b38026566e3be9b94c1b6b0d58636efb472abdb3da8ba67e260ad0fb79c
- MD5 956dd8303c4b5d4bf070868dd7d312c0
- SHA1 5acdf78a148ba04570196106d08a26c43ed2ce50
- SHA512 e546cea930d8e47241cfd69cb2c458149649c875d63065db4ffb940da6f8568c6c861640038f19b7bf95676bc28e453aa1eb472da46f6426a8952c508dcdab5a
- SSDEEP 196608:8pdyn8OyJgV9z8bdsosEU8IBtz/WyZ/K0ttYVAATm6qTfRoa:OdyndVosEU8IBJuyZ/K0ttYZThOWa
- TLSH T1C9E6AE13F2E401B5E0AAD27DC9714632D7717C2A4BB193CF2250B6E91E73BD16A39722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral2/files/0x000900000001b871-4.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral2/files/0x000900000001b871-4.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule behavioral2/files/0x000900000001b871-4.dat UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\getmac.exe 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\NETSTAT.EXE- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\svchost.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\TSTheme.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\verclsid.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\chcp.com 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\choice.exe 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\comp.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\mavinject.exe 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\msfeedssync.exe 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\WerFault.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\calc.exe 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\chkdsk.exe 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\cmstp.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\netbtugc.exe 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\perfhost.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\regedit.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\rekeywiz.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\iscsicpl.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\netiougc.exe 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\xcopy.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\ftp.exe 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\Com\comrepl.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\dpapimig.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\esentutl.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\ttdinject.exe 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\Utilman.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\AtBroker.exe 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\CheckNetIsolation.exe 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\fsquirt.exe 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\mtstocom.exe 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\net.exe 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\ntprint.exe 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\scrnsave.scr- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\regedt32.exe 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\regsvr32.exe 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\gpupdate.exe 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\curl.exe 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\GamePanel.exe 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\gpscript.exe 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\Taskmgr.exe 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\bthudtask.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\dllhost.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\getmac.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\sethc.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\where.exe 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\wscadminui.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\win32calc.exe 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\wsmprovhost.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\grpconv.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\mcbuilder.exe 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\runas.exe 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Windows Defender\MpDefenderCoreService.exe 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseCM.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Windows Defender\DlpUserAgent.exe 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Windows Defender\MpCopyAccelerator.exe 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Internet Explorer\ielowutil.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseImdsCollector.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Internet Explorer\iexplore.exe 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{8F4E2A33-DC18-4884-A646-9283C13498CD}\MicrosoftEdge_X64_139.0.3405.125.exe 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseNdr.exe 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-t..onagent-proxyobject_31bf3856ad364e35_10.0.26100.1150_none_ff5cc17171576ed5\RdpSaProxy.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\msil_addinutil_b77a5c561934e089_10.0.26100.1_none_b94f0eb8a758822f\AddInUtil.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_aspnet_regsql_b03f5f7f11d50a3a_4.0.15912.355_none_cca5d427d5c6dc80\aspnet_regsql.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..mpropertiesadvanced_31bf3856ad364e35_10.0.26100.1_none_fe90da8a8133c864\SystemPropertiesAdvanced.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..extservice.appxmain_31bf3856ad364e35_10.0.26100.1_none_4b95a6089b289b29\Microsoft.AsyncTextService.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fodhelper-ux_31bf3856ad364e35_10.0.26100.1150_none_ced6ba8820394f22\r\fodhelper.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_457f9751bea691f1\tree.com- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-cpl_31bf3856ad364e35_10.0.26100.1591_none_f346527b3b1f36f2\BitLockerWizard.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1738_none_a5031b637767a4e7\TiFileFetcher.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wmi-core-providerhost_31bf3856ad364e35_10.0.26100.1_none_17ab113e28526647\WmiPrvSE.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..eapplifetimemanager_31bf3856ad364e35_10.0.26100.1591_none_02ccdf13e86dfcfe\r\RemoteAppLifetimeManager.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.26100.1591_none_29e868b2edff462b\r\AccountsControlHost.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lua_31bf3856ad364e35_10.0.26100.1150_none_4231ada90cb553fb\consent.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.26100.1591_none_d3181252b1eca58b\r\msra.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-win32calc_31bf3856ad364e35_10.0.26100.1150_none_e5966fa8c7a04cf1\win32calc.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-cipher_31bf3856ad364e35_10.0.26100.1_none_b45ed20d4205ffbb\cipher.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-packagemanager_31bf3856ad364e35_10.0.26100.1591_none_92ec6994d7abdee6\PkgMgr.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-es-authentication_31bf3856ad364e35_10.0.26100.1150_none_dda40d17c682c33c\EhStorAuthn.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ndkperf-setup_31bf3856ad364e35_10.0.26100.1150_none_862cccb1155d1695\NDKPerfCmd.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..temcompareutilities_31bf3856ad364e35_10.0.26100.1_none_fdba4ce39de8ec9f\fc.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1150_none_553b538bcf828876\r\WmiApSrv.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-synchost_31bf3856ad364e35_10.0.26100.1150_none_05685d8fac7c4f66\SyncHost.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_10.0.26100.1_none_91c8eae9745a351d\SystemPropertiesRemote.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_netfx35linq-addinprocess_31bf3856ad364e35_10.0.26100.1_none_2d8ad328b5479b73\AddInProcess.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_hyperv-commandline-tool_31bf3856ad364e35_10.0.26100.1150_none_c8eda2cd3209b21d\r\hvc.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-disksnapshot_31bf3856ad364e35_10.0.26100.1150_none_1c37124e142944f8\DiskSnapshot.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-unlock_31bf3856ad364e35_10.0.26100.1_none_61895966950582dc\bdeunlock.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-whoami_31bf3856ad364e35_10.0.26100.1_none_d5c4d1091ec38541\whoami.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..atibility-assistant_31bf3856ad364e35_10.0.26100.1591_none_cf86813ad32dd96e\pcalua.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.26100.1591_none_125fbf4d94a6971e\r\audiodg.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-browser-brokers_31bf3856ad364e35_11.0.26100.1150_none_160ad4e2bcc0210f\r\browserexport.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..-remoteapplications_31bf3856ad364e35_10.0.26100.1591_none_ddd035314c6868c8\rdpinit.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-upnpdevicehost_31bf3856ad364e35_10.0.26100.1591_none_5da82f9be48ad513\upnpcont.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ServiceModelReg.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winver_31bf3856ad364e35_10.0.26100.1_none_b345269d05057414\winver.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eudcedit_31bf3856ad364e35_10.0.26100.1150_none_f57fd51c6f680fbc\r\eudcedit.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-gpowershell-exe_31bf3856ad364e35_10.0.26100.1591_none_dea5c51b861cb734\powershell_ise.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..ative-serverbox-isv_31bf3856ad364e35_10.0.26100.1_none_fc5f223b9b5c3cc5\RMActivate_ssp_isv.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..csengine-nativehost_31bf3856ad364e35_10.0.26100.1_none_216e3761f97ed1b2\sdiagnhost.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ldifde_31bf3856ad364e35_10.0.26100.1_none_c1bc4da0b901a509\ldifde.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.26100.1150_none_acd0c33b64bc3fcf\iisrstas.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1150_none_553b538bcf828876\r\unsecapp.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.26100.1_none_d1adc81249f528d5\WSManHTTPConfig.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\EdmGen.exe 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-gaming-ga..rnal-presencewriter_31bf3856ad364e35_10.0.26100.1150_none_9e0e1ec5a1c14e55\GameBarPresenceWriter.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-regsvr32_31bf3856ad364e35_10.0.26100.1150_none_143e6dc7df6d80b5\r\regsvr32.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..riencehost.appxmain_31bf3856ad364e35_10.0.26100.1591_none_989a65f2aef55b28\ShellExperienceHost.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ie-ielowutil_31bf3856ad364e35_11.0.26100.1_none_db3c93db8c43c151\ielowutil.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-driververifier-tools_31bf3856ad364e35_10.0.26100.1150_none_5ce3f0df6c2eb9bb\r\verifier.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-photoscreensaver_31bf3856ad364e35_10.0.26100.1150_none_07b5cf4f085fe80c\r\PhotoScreensaver.scr- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tabletpc-inputpanel_31bf3856ad364e35_10.0.26100.1591_none_ad4f10ed27892462\TabTip.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_10.0.26100.1591_none_f3f0f30e057f293d\r\mstsc.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\x86_netfx-dw_b03f5f7f11d50a3a_10.0.26100.1_none_71dc1710cec228ac\dw20.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\x86_wpf-terminalserverwpfwrapperexe_31bf3856ad364e35_10.0.26100.1_none_c5344c677bcead1d\TsWpfWrp.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-volumecontrol_31bf3856ad364e35_10.0.26100.1301_none_61f509cbb778baf7\r\SndVol.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-credwiz_31bf3856ad364e35_10.0.26100.712_none_41fcc82854bc2b0c\r\credwiz.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..-network-management_31bf3856ad364e35_10.0.26100.1591_none_6022424238410d39\r\nmscrub.exe- 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_956dd8303c4b5d4bf070868dd7d312c0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5272
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 15.3MB
- SHA256 935a04dbf02e989d65347af582c52b6184f2a635d2c8a9cc4668a7117a90e01f
- MD5 eceea715c45b80f7437cb3be20e73ed3
- SHA1 5ee4b9b4f91b96ad68451ffbcac0ced5e7f9e6f1
- SHA512 73ec7e37c751f72bf0efd0f7d76602556bd4a6074ad6c666c0e0dadf5ecdc5525f44ef81dc0464d5649886e7b053b9517945615b94fd046453d92401f8ab6c1f
- SSDEEP 196608:8pdyn8OyJgV9z8bdsosEU8IBtz/WyZ/K0ttYVAATm6qTfRoYA:OdyndVosEU8IBJuyZ/K0ttYZThOWV
- TLSH T1AFF6AE13F2E402B6E0B6D179C5725636EB717C1A4B7183CF2244B6E81E73BD16A39722
- MD5 SHA1 SHA512 SSDEEP TLSH