Analysis
- max time kernel
148s - max time network
140s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/08/2026, 16:53
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
- Size 4.7MB
- Sample260820-vd7eea1erc
- SHA256 bda151bff7142364ee5f8ea12a7c393aa17edfc6b351382cc6bf732bfd76c093
- MD5 e63378ab2a0b54b0faa15f20f731243d
- SHA1 94a748c43e63f1cc262dc43d96b86d70b40a9e79
- SHA512 673002852e07b5be751fdf7fd567940689aabdc0dfb9e7df17f010d9663a43cf43298ccc7ba8cf637f6318b679db461a7022616ebc109aea5cc77eaadf2fc3ac
- SSDEEP 49152:kpPZuyWSG+BBvGvnjOyYVGlqRONszVBXdc/RJzVBXfqJtb2Ib+SVBXdcuVBXdcV:khpBinjOykGcPdOR5fmdXdK
- TLSH T1EF369D16B3900277E0B3A175C5AA5701DA7138791B31D3DB7388B25A2E337D2993BB72
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule behavioral2/files/0x000d00000001c55c-4.dat UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\hh.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\icsunattend.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\mmc.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\rundll32.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\OposHost.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\setx.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\shrpubw.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\tasklist.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\perfmon.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\AtBroker.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\systray.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\unlodctr.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cmmon32.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\control.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\dfrgui.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\PresentationHost.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\relog.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\CloudNotifications.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\fontview.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Msdtc\Trace\msdtcvtr.bat- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\proquota.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wowreg32.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ctfmon.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\dtdump.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\PATHPING.EXE 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\timeout.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\TpmTool.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\TSTheme.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\diskperf.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\shutdown.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cleanmgr.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\explorer.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\mmc.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ntprint.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\OpenWith.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\sudo.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\tttracer.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\whoami.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\fltMC.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\newdev.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\sort.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\extrac32.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\isoburn.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\odbcad32.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\runas.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\msinfo32.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\rasphone.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\sdchange.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\lodctr.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\msdt.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\xcopy.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\icsunattend.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\netsh.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\sdchange.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Windows Media Player\wmpshare.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\7-Zip\Uninstall.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Internet Explorer\ielowutil.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Media Player\wmplayer.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\show_third_party_software_licenses.bat- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Media Player\wmpshare.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Mozilla Firefox\updater.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Defender\MpDlpCmd.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Mail\wabmig.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Defender\MpDefenderCoreService.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\show_third_party_software_licenses.bat- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.26100.1591_none_161bc21b2130ea78\r\WerFault.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.26100.1455_none_b184dc3c337d380b\wmpconfig.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\RestartAgent.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.26100.1591_none_9c7590519bc81879\r\vfpctrl.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sctasks_31bf3856ad364e35_10.0.26100.1_none_87331ff41de2f505\schtasks.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.26100.1591_none_cdec79755d491fdb\Setup.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regsql.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.26100.1591_none_d3181252b1eca58b\r\sdchange.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.26100.1591_none_0f19119bcdcaf335\SpeechModelDownload.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-cloudnotifications_31bf3856ad364e35_10.0.26100.1591_none_381c415a75a491aa\CloudNotifications.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-c..periencehost-broker_31bf3856ad364e35_10.0.26100.1150_none_dad1c69b80d09caa\CloudExperienceHostBroker.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..roblemstepsrecorder_31bf3856ad364e35_10.0.26100.1591_none_76b18c52fb009a32\psr.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tabletpc-controlpanel_31bf3856ad364e35_10.0.26100.1_none_dc671a88c37dde08\MultiDigiMon.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wallpaperhost_31bf3856ad364e35_10.0.26100.1150_none_f9eb481555467227\WallpaperHost.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_netfx4-mscorsvw_exe_b03f5f7f11d50a3a_4.0.15912.100_none_752bfd0c9236819e\mscorsvw.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-setx_31bf3856ad364e35_10.0.26100.1_none_b3bf2881b5fdbf6e\setx.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-openwith_31bf3856ad364e35_10.0.26100.1591_none_08e0c9d322babcde\OpenWith.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pnphotplugui_31bf3856ad364e35_10.0.26100.1150_none_84c881fffaa85756\DeviceEject.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-takeown_31bf3856ad364e35_10.0.26100.1_none_f6df0e2a7e2ab480\takeown.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-usercpl-usermgrbroker_31bf3856ad364e35_10.0.26100.1150_none_b29361d684a1914e\UserAccountBroker.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core-svc_31bf3856ad364e35_10.0.26100.1150_none_3c9a0c46a6db0711\WinMgmt.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-tools_31bf3856ad364e35_10.0.26100.1150_none_73e2ba5833894ee6\wbemtest.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..roblemstepsrecorder_31bf3856ad364e35_10.0.26100.1591_none_810636a52f615c2d\psr.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\hh.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\SnapLauncherProtocol.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.26100.1742_none_f6cbfd471cc28a5c\winload.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-recdisc-main_31bf3856ad364e35_10.0.26100.1150_none_20634ae8638b2e34\r\recdisc.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-audio-volumecontrol_31bf3856ad364e35_10.0.26100.1591_none_6c3d16dfebe198e3\SndVol.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-r..-commandline-editor_31bf3856ad364e35_10.0.26100.1_none_38dc86afc79cd565\reg.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-verclsid_31bf3856ad364e35_10.0.26100.1_none_c32f23e8b061a8a0\verclsid.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-x..rtificateenrollment_31bf3856ad364e35_10.0.26100.1591_none_99ab5c6b730e7956\r\CertEnrollCtrl.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SystemApps\Microsoft.Win32WebViewHost_cw5n1h2txyewy\Win32WebViewHost.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-networkbridge_31bf3856ad364e35_10.0.26100.1455_none_a3b05fa5b61855a2\r\bridgeunattend.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-safedocs-main_31bf3856ad364e35_10.0.26100.1591_none_c0c9b77316cf6b10\sdclt.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..-deployment-package_31bf3856ad364e35_10.0.26100.1_none_5bc14811ec1c13bc\TFTP.EXE- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.26100.1_none_b99a252d184bf301\ssh-agent.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\msil_comsvcconfig_b03f5f7f11d50a3a_10.0.26100.1_none_8fc81fd68823646b\ComSvcConfig.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\OOBENetworkCaptivePortal.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-netplwiz-exe_31bf3856ad364e35_10.0.26100.1_none_ea4a5d2678ee83a1\Netplwiz.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_netfx4-csc_exe_b03f5f7f11d50a3a_4.0.15912.338_none_6ee61d3ca59b8c86\csc.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_d8e83661333da001\MRINFO.EXE- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Workflow.Compiler.exe 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..anagement-dmomacpmo_31bf3856ad364e35_10.0.26100.1301_none_6b46da31a1bd9a38\r\DmOmaCpMo.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_7a109607cfe12f00\chcp.com- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..commandlinetoolsmqq_31bf3856ad364e35_10.0.26100.1_none_261d19c21491b907\quser.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1_none_aa346e257779a3b3\TiWorker.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SystemApps\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\AssignedAccessLockApp.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-admincmdtools_31bf3856ad364e35_10.0.26100.1150_none_50956d2d42f20d39\rpcinfo.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.26100.1742_none_227796ba348ec62b\r\MoUsoCoreWorker.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_networking-mpssvc-netsh_31bf3856ad364e35_10.0.26100.1591_none_55053aa4ab175950\r\CheckNetIsolation.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_curl_31bf3856ad364e35_10.0.26100.1301_none_1a384873cd299392\curl.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-es-authentication_31bf3856ad364e35_10.0.26100.1150_none_dda40d17c682c33c\EhStorAuthn.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-webauth_31bf3856ad364e35_10.0.26100.1_none_28969e415f79b32c\AuthHost.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_wp.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-pnp-drvinst_31bf3856ad364e35_10.0.26100.1591_none_f11dd8b719f1a6f5\drvinst.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.26100.1742_none_4a8c1df49b9afb5a\r\Taskmgr.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..andlinepropertytool_31bf3856ad364e35_10.0.26100.1150_none_a7249f5f30c44921\imjpuexc.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..omerfeedbackmanager_31bf3856ad364e35_10.0.26100.1591_none_77f3b6be3e383e20\imecfmui.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-networkbridge_31bf3856ad364e35_10.0.26100.1455_none_a3b05fa5b61855a2\bridgeunattend.exe- 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-20_e63378ab2a0b54b0faa15f20f731243d_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1960
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 5.6MB
- SHA256 b57bbdc30a015ac63ffdfeb0a1dbbe30cb8f8af48836b99f86bcaa8b50e5d745
- MD5 9793740f4158ca3d02f3ccb9e9c11b40
- SHA1 2b17d60e9ebeda586b8fcf30ff4fa7cbb94ae6c5
- SHA512 cd0674f66b9aa9e401efc79cdf5c657a6dd7d6e59c854acf130619bd0ce47ab259ec2a4832e4dda3d55a1a2f2ff5cbebec5284e131104068f024cc207c7efcec
- SSDEEP 98304:khpBinjOykGcPdOR5fmdXdrezSC6v2XMHY:8pAnjOyAdOrfmdXdob
- TLSH T133568C16B2A44377D0B3D179C5AA5755EA7238651B30C3CB6388B26D2E337D2893BB31
- MD5 SHA1 SHA512 SSDEEP TLSH