Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
12/08/2026, 04:32
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe
- Size 18.1MB
- Sample260812-e5z7eaae27
- SHA256 be31d3d3da076d3d4c3438462dd2d9b95e91e7d30748ac06d2143bbf4dcef056
- MD5 75cdf810a22e44936e0f6d7f8ccdb915
- SHA1 10694301d7b2eaf18577d7534a9f544d5e889e69
- SHA512 fc18d82de9de7134960085ffa3cf14352cd3cc7309d941b6d09b688fe5048349ebfd80c1b4ef92bcf780b68cfb9e1eb8bed81e947eac0163179049bf2d6b518b
- SSDEEP 196608:8pAnjOyAdOrNTfNogKmd0JoUdGok1MdkgTH2qBpu1QfLIqsufXV:OAntqnqHQ/THNBpu1Qfc0F
- TLSH T107177C1272D48FA9C06FD038C95266659A333C564F719BDF2580BE693E327E06E3931B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral1/files/0x00120000000243ca-4.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral1/files/0x00120000000243ca-4.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule behavioral1/files/0x00120000000243ca-4.dat UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\UserAccountBroker.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\verclsid.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\fixmapi.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\gpupdate.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\PATHPING.EXE 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\raserver.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\setup16.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\subst.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\chkdsk.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\esentutl.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\relog.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\gpupdate.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\odbcad32.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\quickassist.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\TRACERT.EXE- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\unlodctr.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\convert.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\PkgMgr.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\print.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\RmClient.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\dccw.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\dpapimig.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\wextract.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\CloudNotifications.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\doskey.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\mspaint.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\xwizard.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\credwiz.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\findstr.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\netsh.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\pcaui.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\PickerHost.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\unregmp2.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\wscript.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\fixmapi.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\netbtugc.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\raserver.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\dfrgui.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\control.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\DWWIN.EXE 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\fsutil.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\winrshost.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\cmd.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\tcmsetup.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\cmdl32.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\Dism.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\prevhost.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\ReAgentc.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\sdiagnhost.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\sethc.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\TCPSVCS.EXE 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\diskperf.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\more.com 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\xcopy.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Windows Media Player\wmplayer.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\show_third_party_software_licenses.bat- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Mozilla Firefox\updater.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Windows Media Player\wmpshare.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Windows Mail\wab.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Common Files\microsoft shared\ink\mip.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\dotnet\dotnet.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Windows Media Player\setup_wm.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-scripting_31bf3856ad364e35_10.0.19041.1237_none_bd2b0ef5b58e1540\f\wscript.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-narrator_31bf3856ad364e35_10.0.19041.84_none_b5c0f628d1d661eb\r\Narrator.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..al-chinese-moimeexe_31bf3856ad364e35_10.0.19041.746_none_0f44a2d7a5e3a37a\r\ChtIME.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-gaming-ga..rnal-presencewriter_31bf3856ad364e35_10.0.19041.1202_none_813ba58adb6e7f68\f\GameBarPresenceWriter.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bootconfig_31bf3856ad364e35_10.0.19041.1_none_c2078a8db9a59aef\bootcfg.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ndation-frameserver_31bf3856ad364e35_10.0.19041.1266_none_2a87945d79cbf905\r\FsIso.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-logagent_31bf3856ad364e35_10.0.19041.746_none_c939d70420d81ce4\f\logagent.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-b..re-memorydiagnostic_31bf3856ad364e35_10.0.19041.1_none_987b063fd85ba334\memtest.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-takeown_31bf3856ad364e35_10.0.19041.1_none_ba311d9fe95c6271\takeown.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.1081_none_e4e5027bf1e82209\WerFault.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ddodiag_31bf3856ad364e35_10.0.19041.1_none_f69c49e870acf520\ddodiag.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mspaint_31bf3856ad364e35_10.0.19041.746_none_6c16d1714d60fddf\r\mspaint.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_security-octagon-broker_31bf3856ad364e35_10.0.19041.84_none_51ae5c25baf813ff\r\SgrmBroker.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Microsoft.AAD.BrokerPlugin.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-console-host-core_31bf3856ad364e35_10.0.19041.153_none_4b81b20e830f375b\conhost.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-coresystem-wpr_31bf3856ad364e35_10.0.19041.207_none_4054ef70f69f6ff9\r\wpr.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.19041.1266_none_802f96a5044b0fbe\wmpconfig.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..client-decoder-host_31bf3856ad364e35_10.0.19041.207_none_00b5dbdfab19326f\f\UtcDecoderHost.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_49716c2392052aca\r\tracerpt.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-synchost_31bf3856ad364e35_10.0.19041.746_none_51cf02378fc26da3\r\SyncHost.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_10.0.19041.1_none_ba3fa9706f28b589\dplaysvr.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-powershell-exe_31bf3856ad364e35_10.0.19041.546_none_470f45b46101edfb\powershell.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.19041.1_none_1b0a4d6f748b99f5\fsquirt.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..-network-management_31bf3856ad364e35_10.0.19041.1_none_7a53549f2797bc70\nmbind.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_10.0.19041.1_none_3c360c9e8a3e64cb\msinfo32.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..setup-compatibility_31bf3856ad364e35_10.0.19041.153_none_4e0da8ffdd43ed0d\NetCfgNotifyObjectHost.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-ngc-trustlet_31bf3856ad364e35_10.0.19041.84_none_dd81fb99bc3b1e53\NgcIso.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-x..rtificateenrollment_31bf3856ad364e35_10.0.19041.746_none_d19001beed7624dc\CertEnrollCtrl.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_multipoint-wmssessionagent_31bf3856ad364e35_10.0.19041.1_none_570d39e810ac0f64\WmsSessionAgent.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ieframe_31bf3856ad364e35_11.0.19041.1288_none_1d22271c8cc35d4b\IESettingSync.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.19041.1_none_61cd745a990bcfb3\msinfo32.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-narrator_31bf3856ad364e35_10.0.19041.84_none_b5c0f628d1d661eb\Narrator.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasautodial_31bf3856ad364e35_10.0.19041.546_none_edd345b6c42269da\r\rasautou.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wrp-integrity-client_31bf3856ad364e35_10.0.19041.1_none_eb848512bf047a3b\sfc.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cloudnotifications_31bf3856ad364e35_10.0.19041.1_none_47f8a965309a7ee6\CloudNotifications.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-terminalservices-theme_31bf3856ad364e35_10.0.19041.746_none_b3df5aa8d99e9b89\TSTheme.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-pickerhost_31bf3856ad364e35_10.0.19041.1023_none_2cd9cc4237e09b91\PickerHost.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\x86_addinprocess32_b77a5c561934e089_10.0.19041.1_none_dae2223cd3e6f926\AddInProcess32.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvsystem_31bf3856ad364e35_10.0.19041.84_none_40bd4149a6d52edb\r\AppVClient.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ftp_31bf3856ad364e35_10.0.19041.1_none_62dc6b73f7e78431\ftp.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.1081_none_2e31e8eed4b770c3\unsecapp.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.19041.1151_none_ec390bd802a1c630\r\SearchIndexer.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cleanmgr_31bf3856ad364e35_10.0.19041.1_none_233543e4fce957ae\cleanmgr.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sensordataservice_31bf3856ad364e35_10.0.19041.746_none_dbfd31e3890afb72\f\SensorDataService.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.19041.153_none_c8fbed52dad932cb\f\ResetEngine.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wrp-integrity-client_31bf3856ad364e35_10.0.19041.1_none_e12fdac08aa3b840\sfc.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SystemApps\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\PinningConfirmationDialog.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-apprep-chxapp.appxmain_31bf3856ad364e35_10.0.19041.1_none_edda8130b19d4286\CHXSmartScreen.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-isoburn_31bf3856ad364e35_10.0.19041.746_none_c42bf1ebf80a8661\isoburn.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..sistance-dcomserver_31bf3856ad364e35_10.0.19041.1_none_e5e4ad7714f033ca\raserver.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..nt-enrollmenthelper_31bf3856ad364e35_10.0.19041.1_none_f0bba0af1c8d1f56\PinEnrollmentBroker.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ork-uimanagerbroker_31bf3856ad364e35_10.0.19041.388_none_57e235d809a12c5b\r\UIMgrBroker.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msaudittools_31bf3856ad364e35_10.0.19041.546_none_ffd303094ff1fe66\auditpol.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..scannerpreview-host_31bf3856ad364e35_10.0.19041.546_none_70569b662ddb706c\f\CameraBarcodeScannerPreview.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sethc_31bf3856ad364e35_10.0.19041.746_none_40b989c5d3ea9316\f\EaseOfAccessDialog.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.19041.1202_none_27f9f931a79d1cbe\f\mavinject.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-assignedaccess-guard_31bf3856ad364e35_10.0.19041.844_none_10a0a60f1ec9cc10\AssignedAccessGuard.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-autochk_31bf3856ad364e35_10.0.19041.1266_none_56b9c0cf76f27918\f\autochk.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_10.0.19041.746_none_56f2f7338735a9a6\f\WFS.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-grouppolicy-script_31bf3856ad364e35_10.0.19041.572_none_4d40b8e902f83dd6\f\gpscript.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SystemApps\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\XBox.TCUI.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskapilibrary_31bf3856ad364e35_10.0.19041.1266_none_622873cfbda33994\convertvhd.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vssservice_31bf3856ad364e35_10.0.19041.1_none_10bddbfab734fa42\VSSVC.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1060
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 18.6MB
- SHA256 b57c5fcd10a9f2cf124e2fc01afe44de9102512dcccf55427fef7b8203ab0ed0
- MD5 15c7ffa0bc170df384a18adfa2fff7b8
- SHA1 f547080e093c50df8ed8733a5d8496a241dcd1c6
- SHA512 6a3943e884f36b276a3ae763355b4746713d476cb1b4f1c5e0c5b3b1731650a2224f36cd6a4eba4c4dafc9efe37a2d5af0bc5963789504f80706aef185c19e1a
- SSDEEP 196608:8pAnjOyAdOrNTfNogKmd0JoUdGok1MdkgTH2qBpu1QfLIqsufX1oz:OAntqnqHQ/THNBpu1Qfc0az
- TLSH T1DC177C12B2D48BA9D06FD038C95256659A333C554F719BCF2580BE693E337E06E3632B
- MD5 SHA1 SHA512 SSDEEP TLSH