Analysis
- max time kernel
150s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/08/2026, 04:32
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe
- Size 18.1MB
- Sample260812-e5z7eaae27
- SHA256 be31d3d3da076d3d4c3438462dd2d9b95e91e7d30748ac06d2143bbf4dcef056
- MD5 75cdf810a22e44936e0f6d7f8ccdb915
- SHA1 10694301d7b2eaf18577d7534a9f544d5e889e69
- SHA512 fc18d82de9de7134960085ffa3cf14352cd3cc7309d941b6d09b688fe5048349ebfd80c1b4ef92bcf780b68cfb9e1eb8bed81e947eac0163179049bf2d6b518b
- SSDEEP 196608:8pAnjOyAdOrNTfNogKmd0JoUdGok1MdkgTH2qBpu1QfLIqsufXV:OAntqnqHQ/THNBpu1Qfc0F
- TLSH T107177C1272D48FA9C06FD038C95266659A333C564F719BDF2580BE693E327E06E3931B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral2/files/0x000e00000001c5c9-4.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral2/files/0x000e00000001c5c9-4.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule behavioral2/files/0x000e00000001c5c9-4.dat UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\certreq.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\diskusage.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\setupugc.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\sort.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\verifiergui.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\eventvwr.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\gpresult.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\makecab.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\RMActivate.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\TpmInit.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\ddodiag.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\hdwwiz.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\srdelayed.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\winrshost.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\auditpol.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\colorcpl.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\gpresult.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\TpmTool.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\unlodctr.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\cliconfg.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\SndVol.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\finger.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\lodctr.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\ROUTE.EXE- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\setx.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\whoami.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\AppVDllSurrogate.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\efsui.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\winrs.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\mountvol.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\unregmp2.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\wiaacmgr.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\CheckNetIsolation.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\cmstp.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\diskpart.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\bitsadmin.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\mshta.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\powercfg.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\TSTheme.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\Windows.WARP.JITService.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\cttune.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\msiexec.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\mtstocom.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\OpenWith.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\tree.com- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\tzutil.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\unregmp2.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\bthudtask.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\findstr.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\mode.com 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\RpcPing.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\waitfor.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre-1.8\bin\orbd.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Windows Media Player\wmpshare.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Mozilla Firefox\firefox.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Mozilla Firefox\updater.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Windows Media Player\setup_wm.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Windows Media Player\wmlaunch.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\SystemApps\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\SecureAssessmentBrowser.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fsutil_31bf3856ad364e35_10.0.26100.1150_none_684b64ef9fd684b4\fsutil.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-bash_31bf3856ad364e35_10.0.26100.1150_none_db82af066c7c007e\r\bash.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-reliability-postboot_31bf3856ad364e35_10.0.26100.1591_none_e980cb58b559b151\r\RelPost.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\CBS\WebExperienceHostApp.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-clientcore_31bf3856ad364e35_10.0.26100.1150_none_48c9cd2bf27dfea7\r\nfsclnt.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_multipoint-wmsmanager_31bf3856ad364e35_10.0.26100.1591_none_b7cec9dc382cb5f1\WmsManager.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-calc_31bf3856ad364e35_10.0.26100.1_none_b10653edb7a9547d\calc.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-setx_31bf3856ad364e35_10.0.26100.1_none_b3bf2881b5fdbf6e\setx.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\WFServicesReg.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-grpconv_31bf3856ad364e35_10.0.26100.1_none_9f7bcd3ea63a7384\grpconv.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_10.0.26100.1150_none_49db19f88674c270\r\setup_wm.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msconfig-exe_31bf3856ad364e35_10.0.26100.1591_none_763a39aa4dc6e7d5\msconfig.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-muicachebuilder_31bf3856ad364e35_10.0.26100.1150_none_b5f3ecb264c23d6b\mcbuilder.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-dpapi-keys_31bf3856ad364e35_10.0.26100.1_none_851b25ae6a5e3057\dpapimig.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-explorer_31bf3856ad364e35_10.0.26100.1591_none_ed74a23929c34603\explorer.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.26100.1591_none_d0b554d77644b199\wowreg32.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.26100.1591_none_10f229073c0ac263\r\SearchFilterHost.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\x86_netfx-csharp_compiler_csc_b03f5f7f11d50a3a_10.0.26100.1_none_a2b84bade0a375ce\csc.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-capturepicker.appxmain_31bf3856ad364e35_10.0.26100.1591_none_d07e775d9a3de1d6\CapturePicker.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-impexp-extexport_31bf3856ad364e35_11.0.26100.1150_none_0d9d250a9ce416ba\ExtExport.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mobsyncexe_31bf3856ad364e35_10.0.26100.1150_none_8b382a05043f0680\mobsync.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_netfx-dfsvc_b03f5f7f11d50a3a_10.0.26100.1_none_6694132cb1b96a0b\dfsvc.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SystemApps\LKG\MicrosoftWindows.LKG.Search_cw5n1h2txyewy\FESearchHost.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appidcore_31bf3856ad364e35_10.0.26100.1591_none_ca90d4b7666bc2e5\r\appidtel.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-runtimebroker_31bf3856ad364e35_10.0.26100.1591_none_321363d9581bd94b\RuntimeBroker.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dispdiag_31bf3856ad364e35_10.0.26100.1591_none_e0a4647be01e0453\r\dispdiag.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-icacls_31bf3856ad364e35_10.0.26100.1_none_2fa847710e86cbe0\icacls.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.26100.1591_none_986ba09695018480\r\UevTemplateConfigItemGenerator.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mspaint_31bf3856ad364e35_10.0.26100.1150_none_2a04d71b9e7ba19d\r\mspaint.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.26100.1150_none_fb078fe8106f7572\r\cmdl32.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wab-app_31bf3856ad364e35_10.0.26100.1_none_3f9d05e1401f38e7\wab.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..cesframework-ctfmon_31bf3856ad364e35_10.0.26100.1591_none_4345324c74f92366\ctfmon.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-containerdiagnosticstool_31bf3856ad364e35_10.0.26100.1150_none_234860e0e753c908\r\hcsdiag.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-vaultcmd_31bf3856ad364e35_10.0.26100.1_none_e3755908c2899c00\VaultCmd.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-netsh_31bf3856ad364e35_10.0.26100.1_none_66e948f094c62ed2\netsh.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shellhost_31bf3856ad364e35_10.0.26100.1_none_136be58c8b89053d\sihost.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_ce938c0efedcde06\r\TCPSVCS.EXE- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.26100.1_none_a518656df7c165fb\SenseCE.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..cation-creduibroker_31bf3856ad364e35_10.0.26100.1591_none_70cfc556f1a01eb7\r\CredentialUIBroker.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-netbt_31bf3856ad364e35_10.0.26100.1_none_67ad1b14943183e5\netbtugc.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_d8e83661333da001\finger.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.26100.1591_none_986ba09695018480\UevAppMonitor.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-clientcmdtools_31bf3856ad364e35_10.0.26100.1150_none_ed4ab399a05c1619\r\mount.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_wcf-smsvchost_b03f5f7f11d50a3a_10.0.26100.1_none_97a994ca02046ab4\SMSvcHost.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.26100.1742_none_f6cbfd471cc28a5c\winload.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..cecontroller-minwin_31bf3856ad364e35_10.0.26100.1591_none_dad8c095acaa16b9\services.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.26100.1_none_686bcd839bc27ad8\tracerpt.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.26100.1591_none_97b3f064acd38654\SecureAssessmentBrowser.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_netfx4-servicemodelreg_exe_b03f5f7f11d50a3a_4.0.15912.0_none_cee89c9eae78ac91\ServiceModelReg.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-robocopy_31bf3856ad364e35_10.0.26100.1591_none_6d1bd4f9d0cbd5f8\Robocopy.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..cesframework-ctfmon_31bf3856ad364e35_10.0.26100.1591_none_4345324c74f92366\r\ctfmon.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.26100.1591_none_68327241782dd35b\r\AppVNice.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_7a109607cfe12f00\print.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-grouppolicy-script_31bf3856ad364e35_10.0.26100.1_none_6c5f8b350c999f6d\gpscript.exe- 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-12_75cdf810a22e44936e0f6d7f8ccdb915_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:936
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 19.0MB
- SHA256 c6ceb59fa337821f6a2c54da8b6209465d98e696ceb3cce2d34010936797c750
- MD5 49516731a2d1f6303ec3d28a6e833caa
- SHA1 8cddb4d5ffe299ac63cd04454e0a58232cd7275e
- SHA512 90a51d37cb9616faeadb7598eff514a48ec9339b99b28158d99a756400fbc5e3b31617f4b416a5c08197108643b6a03458b325409f38e4339f745853cc480d06
- SSDEEP 196608:8pAnjOyAdOrNTfNogKmd0JoUdGok1MdkgTH2qBpu1QfLIqsufXBF:OAntqnqHQ/THNBpu1Qfc0n
- TLSH T14A177C12B2E44BA9D06FD078C9526665EA333C454F719BCF2540BE693E337E06A3532B
- MD5 SHA1 SHA512 SSDEEP TLSH