Analysis
- max time kernel
150s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/08/2026, 17:10
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
- Size 16.4MB
- Sample260820-vp44esef98
- SHA256 ca24f778bff2cc313b18927614d3ffdbad43c47c7ee350a5d71c81cca992a128
- MD5 c31d1f6acec5ae5ad0c524c9e54e113e
- SHA1 60586e79254065cce31ecde8fa606f36f046730e
- SHA512 ea3cecd23f6bb4a8cf393673a0cc35cf01ecdf19ee3d74d5a4284ce71abc79dd5d1aeb6b1a504fb4b28cdc06e87df791235655664584cab8c237103c565d61ad
- SSDEEP 196608:8pAnjOyAdOrNTfNogKmd0JoUdGok1mTfhTfQ:OAntqnqHQrdY
- TLSH T12B077C1273E44627E0AA927EC4714A3997717C3A9B72C2CF3544B99E19737C29A37323
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral2/files/0x0005000000016b4e-4.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral2/files/0x0005000000016b4e-4.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule behavioral2/files/0x0005000000016b4e-4.dat UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\psr.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\recover.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\bitsadmin.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\help.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\MRINFO.EXE- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\timeout.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\chkdsk.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\certreq.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\icacls.exe 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\schtasks.exe 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\timeout.exe 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\eventvwr.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\mstsc.exe 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\verclsid.exe 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\rasphone.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wsmprovhost.exe 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\sdiagnhost.exe 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\gpresult.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\instnm.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\regedt32.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\RpcPing.exe 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ftp.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\gpscript.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\OposHost.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\PickerHost.exe 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\setupugc.exe 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\dccw.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Netplwiz.exe 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\tcmsetup.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ROUTE.EXE 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ttdinject.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\auditpol.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cmdkey.exe 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\netsh.exe 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\rasautou.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\w32tm.exe 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cttunesvr.exe 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\upnpcont.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\winrshost.exe 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wscadminui.exe 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\getmac.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\LaunchTM.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\mfpmp.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\schtasks.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SystemUWPLauncher.exe 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\TCPSVCS.EXE 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\tttracer.exe 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\nslookup.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\fixmapi.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\regedit.exe 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\choice.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Mozilla Firefox\updater.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Windows Defender\MpCmdRun.exe 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\show_third_party_software_licenses.bat 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Internet Explorer\iexplore.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\Classification\SenseCE.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Media Player\wmpshare.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-ftp_31bf3856ad364e35_10.0.26100.1301_none_48b7f6550888b909\r\ftp.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sort_31bf3856ad364e35_10.0.26100.1150_none_47a573c9c96cd2e9\r\sort.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-takeown_31bf3856ad364e35_10.0.26100.1_none_f6df0e2a7e2ab480\takeown.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.26100.1150_none_664cc5d65cf1b4d8\wsmprovhost.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wwan-lpasvc-esimtool_31bf3856ad364e35_10.0.26100.1150_none_77014dd1054075c3\esimtool.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_netfx-ieexec_b03f5f7f11d50a3a_10.0.26100.1_none_4db4eeca2cb94664\IEExec.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.26100.1_none_686bcd839bc27ad8\typeperf.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..scannerpreview-host_31bf3856ad364e35_10.0.26100.1150_none_2e44a4dc7ef60e78\r\CameraBarcodeScannerPreview.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.26100.1150_none_acd0c33b64bc3fcf\iisreset.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-oobe-machine_31bf3856ad364e35_10.0.26100.1591_none_a93e455bb3388085\msoobe.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_10.0.26100.1_none_91c8eae9745a351d\SystemPropertiesRemote.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-storage-diagnostics_31bf3856ad364e35_10.0.26100.1591_none_1ac5fa16ecade80d\stordiag.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\winhlp32.exe 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_aspnet_regsql_b03f5f7f11d50a3a_4.0.15912.0_none_acc2fb65a486a112\aspnet_regsql.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.26100.1150_none_7c0a3bab447f4af9\ByteCodeGenerator.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-diskusage_31bf3856ad364e35_10.0.26100.1150_none_4db6a2c1b58489e5\diskusage.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-x..rtificateenrollment_31bf3856ad364e35_10.0.26100.1591_none_8f56b2193eadb75b\CertEnrollCtrl.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SystemApps\Microsoft.AccountsControl_cw5n1h2txyewy\AccountsControlHost.exe 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.26100.1150_none_36fd183d90da21cb\immersivetpmvscmgrsvr.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..client-decoder-host_31bf3856ad364e35_10.0.26100.1591_none_be5055bdfc720d1e\UtcDecoderHost.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.26100.1_none_fcf0e4a9852b11e5\ssh-keyscan.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..cation-creduibroker_31bf3856ad364e35_10.0.26100.1591_none_667b1b04bd3f5cbc\r\CredentialUIBroker.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-commandlinehelp_31bf3856ad364e35_10.0.26100.1_none_d11ede0471c43ced\help.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..al-chinese-moimeexe_31bf3856ad364e35_10.0.26100.1150_none_cd32a881f6fe4738\ChtIME.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ageengine-utilities_31bf3856ad364e35_10.0.26100.1591_none_754be8247547f871\esentutl.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-openwith_31bf3856ad364e35_10.0.26100.1591_none_08e0c9d322babcde\r\OpenWith.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lishing-wmiprovider_31bf3856ad364e35_10.0.26100.1150_none_d11fa90f43730842\r\rdpsign.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_windows-defender-service_31bf3856ad364e35_10.0.26100.1_none_c299cb2ebf592e77\MpCmdRun.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-autofstx_31bf3856ad364e35_10.0.26100.1591_none_55245726ccbb616f\autofstx.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..frameworks-usermode_31bf3856ad364e35_10.0.26100.1591_none_38d18bb2a54a6d36\WUDFHost.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.26100.1591_none_51f10c4fde15e277\msinfo32.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-netsh_31bf3856ad364e35_10.0.26100.1_none_66e948f094c62ed2\netsh.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-shell-previewhost_31bf3856ad364e35_10.0.26100.1_none_4a85b7d59dcc025f\prevhost.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft.powershell.pester_31bf3856ad364e35_10.0.26100.1150_none_7a6e656d581b85dd\Pester.bat- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\x86_aspnet_regsql_b03f5f7f11d50a3a_10.0.26100.1_none_f419bf716fbd61e7\aspnet_regsql.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..ssociationframework_31bf3856ad364e35_10.0.26100.1591_none_4606dbfb8b0028fd\dasHost.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.26100.1150_none_8097a9dca8ee24c4\qprocess.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_vmconnect_31bf3856ad364e35_10.0.26100.1591_none_2bf6278ffa2525b6\r\vmconnect.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ldifde_31bf3856ad364e35_10.0.26100.1_none_c1bc4da0b901a509\ldifde.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..line-user-interface_31bf3856ad364e35_10.0.26100.1150_none_78cec33b8cc1ebd0\cmdkey.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1_none_065309a92fd714e9\containerworker.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_vmconnect_31bf3856ad364e35_10.0.26100.1591_none_2bf6278ffa2525b6\vmconnect.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.26100.1742_none_54e0c846cffbbd55\r\LaunchTM.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CasPol.exe 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appid_31bf3856ad364e35_10.0.26100.1_none_543fb8ac1ab3e68b\appidpolicyconverter.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..-network-management_31bf3856ad364e35_10.0.26100.1591_none_6022424238410d39\r\nmscrub.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ng-server-isolation_31bf3856ad364e35_10.0.26100.1591_none_386f0e150ea90546\r\PrintIsolationHost.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_security-octagon-broker_31bf3856ad364e35_10.0.26100.1150_none_f5f28f643cc492d0\SgrmBroker.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-chkdsk_31bf3856ad364e35_10.0.26100.1_none_c92eac93299dda10\chkdsk.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sethc_31bf3856ad364e35_10.0.26100.1591_none_08d4e4725982e790\r\EaseOfAccessDialog.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\csc.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.26100.1150_none_acd0c33b64bc3fcf\iisrstas.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.26100.1591_none_a08d59ccf9531fab\icsunattend.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..andlinepropertytool_31bf3856ad364e35_10.0.26100.1150_none_a7249f5f30c44921\imjpuexc.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wwan-lpasvc-esimtool_31bf3856ad364e35_10.0.26100.1150_none_77014dd1054075c3\r\esimtool.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.26100.1591_none_161bc21b2130ea78\r\WerFaultSecure.exe- 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5196
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 17.3MB
- SHA256 7a14f4a5309b809d62e678a0eb19ffdee8039eb6f3a1fa56258af601803a6760
- MD5 e450da6173127fb6b850383d552e0d28
- SHA1 1ae477d6cf901da26056c1b773cf9616db0879ee
- SHA512 a37a377c902cbb56afb183cb6f2648978e67c83c7a3cdea55603739e8ff099bb105cea4d1348f2ead8f9b0f1bc09f91b9d754d8a29955a98dde94fd92a71b146
- SSDEEP 196608:8pAnjOyAdOrNTfNogKmd0JoUdGok1mTfhTf2M:OAntqnqHQrdD
- TLSH T10E077C12B2E44627E0BA927EC4B14A39D771782A5B72C2CF3544B59E2D737C29637323
- MD5 SHA1 SHA512 SSDEEP TLSH