Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
20/08/2026, 16:53
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
- Size 4.7MB
- Sample260820-vd7eea1erc
- SHA256 bda151bff7142364ee5f8ea12a7c393aa17edfc6b351382cc6bf732bfd76c093
- MD5 e63378ab2a0b54b0faa15f20f731243d
- SHA1 94a748c43e63f1cc262dc43d96b86d70b40a9e79
- SHA512 673002852e07b5be751fdf7fd567940689aabdc0dfb9e7df17f010d9663a43cf43298ccc7ba8cf637f6318b679db461a7022616ebc109aea5cc77eaadf2fc3ac
- SSDEEP 49152:kpPZuyWSG+BBvGvnjOyYVGlqRONszVBXdc/RJzVBXfqJtb2Ib+SVBXdcuVBXdcV:khpBinjOykGcPdOR5fmdXdK
- TLSH T1EF369D16B3900277E0B3A175C5AA5701DA7138791B31D3DB7388B25A2E337D2993BB72
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule behavioral1/files/0x0003000000022b20-3.dat UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\doskey.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\perfmon.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Robocopy.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SecEdit.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\bitsadmin.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\find.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Fondue.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\lodctr.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\openfiles.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\RdpSa.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\rekeywiz.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cttunesvr.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\fc.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\shrpubw.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Utilman.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\CloudNotifications.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\hdwwiz.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\resmon.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\subst.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\autochk.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\CheckNetIsolation.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Msdtc\Trace\msdtcvtr.bat 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\sdchange.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\sfc.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\TpmInit.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cmdl32.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\msdt.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\msiexec.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\regini.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\userinit.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\rasphone.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\clip.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\dpapimig.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\gpscript.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\hdwwiz.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\poqexec.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\rundll32.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\dccw.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Dism.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\tcmsetup.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Windows.WARP.JITService.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\calc.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ddodiag.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\upnpcont.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\autoconv.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\isoburn.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\netbtugc.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\tracerpt.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\whoami.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\winver.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\isoburn.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\OposHost.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\xcopy.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\dpnsvr.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\mcbuilder.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Media Player\wmpshare.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Windows Media Player\wmplayer.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\dotnet\dotnet.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Mozilla Firefox\updater.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Windows Mail\wabmig.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-com-surrogate_31bf3856ad364e35_10.0.19041.1_none_fa14fc3992df87f1\dllhst3g.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..andlinepropertytool_31bf3856ad364e35_10.0.19041.844_none_e9349b06dfab6fdc\r\imjpuexc.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..ysafety-refreshtask_31bf3856ad364e35_10.0.19041.1266_none_d375b5361b806b32\WpcTok.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager_31bf3856ad364e35_10.0.19041.1202_none_7cdad2e52790705d\r\wdagtool.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-scripting_31bf3856ad364e35_10.0.19041.1237_none_c77fb947e9eed73b\cscript.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-spelling-host.binaries_31bf3856ad364e35_10.0.19041.746_none_eb2cdd2a40f60c45\r\MsSpellCheckingHost.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_multipoint-wmssessionagent_31bf3856ad364e35_10.0.19041.746_none_7f157730d01dcdae\WmsSessionAgent.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.19041.1_none_8aab2d3580c614cb\WSManHTTPConfig.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..ing-management-core_31bf3856ad364e35_10.0.19041.746_none_ad0ed54dd130eec3\r\DismHost.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvsystem_31bf3856ad364e35_10.0.19041.1081_none_bdf809eb2dd695f9\f\AppVClient.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.19041.1266_none_802f96a5044b0fbe\wmpconfig.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SystemApps\Microsoft.Win32WebViewHost_cw5n1h2txyewy\Win32WebViewHost.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..dialoghost.appxmain_31bf3856ad364e35_10.0.19041.423_none_edab5dd3a4c202d9\CredDialogHost.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..b-standardcollector_31bf3856ad364e35_10.0.19041.928_none_0f531ea0d233243b\f\DiagnosticsHub.StandardCollector.Service.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-magnify_31bf3856ad364e35_10.0.19041.84_none_65d0f4a4c6cd4975\r\Magnify.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.19041.1_none_20dbe0239a0c22b4\vds.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-compact_31bf3856ad364e35_10.0.19041.1_none_ba3af2a08950d1cb\compact.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.19041.153_none_70cb6ca43c818606\cmimageworker.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_49716c2392052aca\typeperf.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..opertiesperformance_31bf3856ad364e35_10.0.19041.1_none_1b1c6505d69885a4\SystemPropertiesPerformance.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..rnetprinting-client_31bf3856ad364e35_10.0.19041.1_none_40c3733167c0c0bd\wpnpinst.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..csengine-nativehost_31bf3856ad364e35_10.0.19041.1_none_da6b9c85304fbda8\sdiagnhost.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..eldebugger-recorder_31bf3856ad364e35_10.0.19041.746_none_4cb1ff2aa122b5dd\f\tttracer.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.19041.1_none_330dfb2b06b21af6\print.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..rarydialog.appxmain_31bf3856ad364e35_10.0.19041.423_none_abd26b7610cb738e\AddSuggestedFoldersToLibraryDialog.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-control_31bf3856ad364e35_10.0.19041.423_none_7777dd52093f9dd6\control.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..setup-compatibility_31bf3856ad364e35_10.0.19041.746_none_4e1b852ddd390c0b\NetCfgNotifyObjectHost.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Speech\Common\sapisvr.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..riseclientsync-host_31bf3856ad364e35_10.0.19041.207_none_ac38fc33d542b487\WorkFolders.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-gdi_31bf3856ad364e35_10.0.19041.1165_none_1ea3d2b20faf7de3\fontdrvhost.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-analog-facefodhandler_31bf3856ad364e35_10.0.19041.1_none_604b329da953cf68\FaceFodUninstaller.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..usnotificationuxexe_31bf3856ad364e35_10.0.19041.153_none_51feabe070ab84f6\MusNotificationUx.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-runtimebroker_31bf3856ad364e35_10.0.19041.1_none_4c44763647728882\RuntimeBroker.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-scripting_31bf3856ad364e35_10.0.19041.1237_none_bd2b0ef5b58e1540\r\cscript.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wow64-legacy_31bf3856ad364e35_10.0.19041.1023_none_6aeab5d4bd0371a8\setup16.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.19041.264_none_08acfd4a9926561a\r\wermgr.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.19041.1_none_3d62a57d3b12dcf1\doskey.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.19041.1_none_f79dcf01d5a416bd\msra.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..onment-core-tcbboot_31bf3856ad364e35_10.0.19041.264_none_de5e254ba7caf399\tcblaunch.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..diagnostic-schedule_31bf3856ad364e35_10.0.19041.1_none_49c7a9c019150ac4\MdSched.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-diskpart_31bf3856ad364e35_10.0.19041.964_none_510ebdd9292eed06\diskpart.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.19041.906_none_198d8d483aa30ed0\f\gpupdate.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..sistance-dcomserver_31bf3856ad364e35_10.0.19041.1110_none_a4bfcaa32abfcf0e\r\raserver.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..sktop.appxmain.root_31bf3856ad364e35_10.0.19041.264_none_a71c9f7fdcd899c5\SearchApp.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-usercpl-usermgrbroker_31bf3856ad364e35_10.0.19041.746_none_f4a55c2c3386ed90\UserAccountBroker.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_eventviewersettings_31bf3856ad364e35_10.0.19041.1_none_b53d8fdcd7716c78\eventvwr.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\x86_netfx4-aspnet_state_exe_b03f5f7f11d50a3a_4.0.15805.0_none_a7a9eea53631000d\aspnet_state.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..mnotificationbroker_31bf3856ad364e35_10.0.19041.746_none_a5ade2e84580e250\DmNotificationBroker.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ntalcontrolsmonitor_31bf3856ad364e35_10.0.19041.1266_none_bfb5312df2d5c960\r\WpcMon.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..tionsimulationinput_31bf3856ad364e35_10.0.19041.746_none_492c8c53f3547077\r\PerceptionSimulationInput.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-waitfor_31bf3856ad364e35_10.0.19041.1_none_6c56c3651a911f63\waitfor.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.19041.1_none_5c4f760174b23886\resmon.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-autofmt_31bf3856ad364e35_10.0.19041.1266_none_5aba1063745f6e01\r\autofmt.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\f\MicrosoftEdge.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pickerhost_31bf3856ad364e35_10.0.19041.1023_none_228521f0037fd996\PickerHost.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_windows-defender-offline-amcore_31bf3856ad364e35_10.0.19041.1202_none_b9662ef4fe1412ad\f\OfflineScannerShell.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devicecensus_31bf3856ad364e35_10.0.19041.1202_none_24329c73afbd2316\r\DeviceCensus.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..riencehost.appxmain_31bf3856ad364e35_10.0.19041.423_none_bfcb7b02f95b1e52\PeopleExperienceHost.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-powershell-exe_31bf3856ad364e35_10.0.19041.546_none_470f45b46101edfb\powershell.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.19041.264_none_5481650943811810\audiodg.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bcdboot-cmdlinetool_31bf3856ad364e35_10.0.19041.1237_none_d618a074f3588a53\f\bcdboot.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ftp_31bf3856ad364e35_10.0.19041.1_none_62dc6b73f7e78431\ftp.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..iodatamodel-library_31bf3856ad364e35_10.0.19041.264_none_52f277f293540161\WinBioDataModelOOBE.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..llshield-wow64-main_31bf3856ad364e35_10.0.19041.1081_none_e34aea343fc255b7\_isdel.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3864
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 5.2MB
- SHA256 8f15a94d31156fa81b8bac7c51da29b25433ea65661140d97b8c54c7be75bc02
- MD5 107c9d176889c1bfb7ee1dd97528a704
- SHA1 48919d4a7afff28a6f00ff1a7d974edd38f30376
- SHA512 7f83d5640211d55b8be419d95c94c68e39e59de5aa519eb42a90d73980f4843d8f39872962461f0c3f6e92cf50f1d14a8dbf9639c8e8e9adfd30b72b3fc21b41
- SSDEEP 49152:kpPZuyWSG+BBvGvnjOyYVGlqRONszVBXdc/RJzVBXfqJtb2Ib+SVBXdcuVBXdchc:khpBinjOykGcPdOR5fmdXd2jod
- TLSH T117469D16B3904277E0B39175C5AA5745EA7138651B31C3CB7388B26E2E337D2993BB32
- MD5 SHA1 SHA512 SSDEEP TLSH