Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
23/08/2026, 17:14
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
- Size 10.8MB
- Sample260823-vsfv1attdx
- SHA256 e41980706bff9abbef2467e26c60b4a2710d15c81d1ebcd987e8909964df0d57
- MD5 e657d419efdd21fa16bbfd76ea4b1fc5
- SHA1 1225300502c01001369204aed4ee0b2222f71141
- SHA512 73828b31ded91d774901151ed3a1a482981c36c4ec7fbc4561fb5a91cbe14d4b412511d9eabfab7448ea0ade5baa95e887203739a83c3787d49fed6545517d62
- SSDEEP 196608:8pAnjOyAdOrfyKmd0jdBVoDco1EU8I4P9:OAnBqrv1EU8IS
- TLSH T14AB69E16F2A44276D0B3C078C9969766EB713C5907B0C6DB2284B7E92F33BD1763A721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule behavioral1/files/0x0005000000016917-4.dat UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\driverquery.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\OneDriveSetup.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\scrnsave.scr 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\setupugc.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\systeminfo.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SystemUWPLauncher.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\mcbuilder.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\compact.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\netbtugc.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\openfiles.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\colorcpl.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\dplaysvr.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\dvdplay.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\systray.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\where.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\charmap.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ctfmon.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\help.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\msinfo32.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ReAgentc.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\rrinstaller.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\tree.com- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\TSTheme.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\at.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\TpmInit.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wsmprovhost.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cmdkey.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\runonce.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\svchost.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ftp.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Magnify.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\proquota.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\systeminfo.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\upnpcont.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\expand.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\fc.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\PresentationHost.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\tar.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cttunesvr.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\efsui.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\mshta.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\PATHPING.EXE 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\pcaui.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\TapiUnattend.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\write.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\control.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\eventcreate.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\icsunattend.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wowreg32.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\find.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wscadminui.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\attrib.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\dfrgui.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\dllhst3g.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\extrac32.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\7-Zip\7zFM.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\show_third_party_software_licenses.bat 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\show_third_party_software_licenses.bat 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Windows Mail\wab.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\show_third_party_software_licenses.bat- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_9aa166e99861c2bc\qprocess.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wusa_31bf3856ad364e35_10.0.19041.1151_none_21d0a68ccdc67be8\wusa.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.19041.1_none_6c221eaccd6c91ae\msinfo32.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-u..onwakesettingflyout_31bf3856ad364e35_10.0.19041.746_none_949b3f6674b404fa\r\PasswordOnWakeSettingFlyout.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..perience-ait-static_31bf3856ad364e35_10.0.19041.1202_none_a5a4c3f2637b55fa\aitstatic.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..screencontentserver_31bf3856ad364e35_10.0.19041.1_none_bd38794249e3d110\LockScreenContentServer.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..iondata-cmdlinetool_31bf3856ad364e35_10.0.19041.1202_none_fceb29af5a61f7e6\f\bcdedit.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pcwdiagnostic_31bf3856ad364e35_10.0.19041.1266_none_69f1a169b4d96a7c\pcwrun.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cttunesvr_31bf3856ad364e35_10.0.19041.1_none_a5ebe4c7bdb5bb85\cttunesvr.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-bash_31bf3856ad364e35_10.0.19041.1151_none_b46b739f71bbb8b7\f\bash.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..spaces-spacemanager_31bf3856ad364e35_10.0.19041.1266_none_bee3df875f7e71bb\spaceman.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.19041.1151_none_ec390bd802a1c630\SearchProtocolHost.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.19041.746_none_8457b34a3423f6d0\perfmon.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.19041.1_none_1f65f7473443d565\cmstp.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msaudittools_31bf3856ad364e35_10.0.19041.1_none_cd761f3a5c1f786f\auditpol.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..alservices-webproxy_31bf3856ad364e35_10.0.19041.746_none_0f70f5a5b71ec478\TSWbPrxy.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..raries-servercommon_31bf3856ad364e35_10.0.19041.906_none_87b019d7cebd66d4\iissetup.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lua_31bf3856ad364e35_10.0.19041.746_none_8443a7febb9ab03d\f\consent.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sethc_31bf3856ad364e35_10.0.19041.1_none_18b14c7d1478d4cc\sethc.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lications-clientsku_31bf3856ad364e35_10.0.19041.1266_none_93a0f3defb54e912\rdpshell.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-grouppolicy-script_31bf3856ad364e35_10.0.19041.1_none_255cf058436a8b63\gpscript.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-runonce_31bf3856ad364e35_10.0.19041.1202_none_94cfabd8a89f0b96\r\runonce.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-x..jectdialog.appxmain_31bf3856ad364e35_10.0.19041.423_none_d93ee361fbbc8f0a\r\XGpuEjectDialog.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.1202_none_2dfbb21bd5166adc\LaunchTM.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1151_none_71aa7fdbb41824a0\f\ShellExperienceHost.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1_none_97b0a47239f6db64\PeopleExperienceHost.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-starttiledata_31bf3856ad364e35_10.0.19041.1202_none_05856bbd8f935e6b\DataStoreCacheDumpTool.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_multipoint-wmsuseragent_31bf3856ad364e35_10.0.19041.1_none_16cc981df6cf3111\WmsUserAgent.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-scripting_31bf3856ad364e35_10.0.19041.1237_none_c77fb947e9eed73b\f\wscript.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\x86_wpf-terminalserverwpfwrapperexe_31bf3856ad364e35_10.0.19041.1_none_7e31b18ab29f9913\TsWpfWrp.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMConfigInstaller.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SystemApps\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\AssignedAccessLockApp.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_aspnet_regbrowsers_b03f5f7f11d50a3a_10.0.19041.1_none_82a36c559596820a\aspnet_regbrowsers.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_wp.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..scannerpreview-host_31bf3856ad364e35_10.0.19041.546_none_70569b662ddb706c\f\CameraBarcodeScannerPreview.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.19041.1288_none_1cec63974464878f\SenseSC.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.844_none_67b5915b5651dd8a\ImeBroker.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.19041.746_none_770f598aef14382e\r\dfrgui.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-spectrum_31bf3856ad364e35_10.0.19041.153_none_59d1094dec9b8480\f\Spectrum.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..etpc-mathinputpanel_31bf3856ad364e35_10.0.19041.746_none_a89acde4afbab635\f\mip.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1_none_6331d348ae4a8fa9\TiFileFetcher.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-usercpl-usermgrbroker_31bf3856ad364e35_10.0.19041.746_none_f4a55c2c3386ed90\f\UserAccountBroker.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.19041.928_none_bd769d14dfd7d29d\f\sdbinst.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.19041.1081_none_5500d10e49b43346\r\ByteCodeGenerator.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mapi_31bf3856ad364e35_10.0.19041.1_none_613e4ed2b91d35a0\fixmapi.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-speech-userexperience_31bf3856ad364e35_10.0.19041.1_none_d1fafd8eeb2a2637\SpeechUXWiz.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.19041.1_none_5c4f760174b23886\perfmon.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..sktop.appxmain.root_31bf3856ad364e35_10.0.19041.264_none_a71c9f7fdcd899c5\f\SearchApp.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_windows-gaming-xbox..e-service-component_31bf3856ad364e35_10.0.19041.264_none_31474dbf12ce5adc\XblGameSaveTask.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_a4f6113bccc284b7\tsdiscon.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-analog-facefodhandler_31bf3856ad364e35_10.0.19041.1266_none_1f1ff89fbf279f16\FaceFodUninstaller.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dns-client_31bf3856ad364e35_10.0.19041.572_none_bfb752f1e1449c59\dnscacheugc.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filehistory-core_31bf3856ad364e35_10.0.19041.1110_none_29d8ec742bfd8b13\fhmanagew.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-grouppolicy-script_31bf3856ad364e35_10.0.19041.1_none_1b0846060f09c968\gpscript.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_ef0e010d1381269b\f\iisreset.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-synchost_31bf3856ad364e35_10.0.19041.746_none_477a57e55b61aba8\r\SyncHost.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lications-clientsku_31bf3856ad364e35_10.0.19041.1266_none_93a0f3defb54e912\f\rdpshell.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_11.0.19041.1202_none_512e9d368c70b758\f\iexplore.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1_none_b29cb2f3845833b7\UevTemplateBaselineGenerator.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-blb-cli-main_31bf3856ad364e35_10.0.19041.1202_none_c0150a0a443c0ffc\r\wbadmin.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Microsoft.AAD.BrokerPlugin.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CasPol.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tapisetup_31bf3856ad364e35_10.0.19041.746_none_52411fe22e5a0ca1\TapiUnattend.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-calc_31bf3856ad364e35_10.0.19041.1_none_6a03b910ee7a4073\calc.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3600
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 11.4MB
- SHA256 9e01a94fe941d740635eb1ca2be343f3636c437ea20ec74e14b191ddcac48101
- MD5 ab9e5c0b21eaf58d1707f6b1fd2a129b
- SHA1 16740f1c7084def83b4db74f3e4684c77eeebfd2
- SHA512 26e4377df85ad11c58153c9d3f289b74caaf703037b9f01541a10c93a376cee981de0329b6f89f3edbd9b880bbf0426ac62595c235ba6adc7669c3231d2b5219
- SSDEEP 196608:8pAnjOyAdOrfyKmd0jdBVoDco1EU8I4Ptor:OAnBqrv1EU8IXr
- TLSH T183C69E16F2A44276D073C078C9969766EB713C5907B0C6DB2284F7E92F33BD1A63A721
- MD5 SHA1 SHA512 SSDEEP TLSH