Analysis
- max time kernel
150s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/08/2026, 17:14
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
- Size 10.8MB
- Sample260823-vsfv1attdx
- SHA256 e41980706bff9abbef2467e26c60b4a2710d15c81d1ebcd987e8909964df0d57
- MD5 e657d419efdd21fa16bbfd76ea4b1fc5
- SHA1 1225300502c01001369204aed4ee0b2222f71141
- SHA512 73828b31ded91d774901151ed3a1a482981c36c4ec7fbc4561fb5a91cbe14d4b412511d9eabfab7448ea0ade5baa95e887203739a83c3787d49fed6545517d62
- SSDEEP 196608:8pAnjOyAdOrfyKmd0jdBVoDco1EU8I4P9:OAnBqrv1EU8IS
- TLSH T14AB69E16F2A44276D0B3C078C9969766EB713C5907B0C6DB2284B7E92F33BD1763A721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule behavioral2/files/0x000d00000001c52e-4.dat UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Com\MigRegDB.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\label.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\net1.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\odbcad32.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\poqexec.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cleanmgr.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\hdwwiz.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\notepad.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\PATHPING.EXE- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Speech_OneCore\Common\SpeechModelDownload.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SyncHost.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\where.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cipher.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\netbtugc.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\RMActivate.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\TpmTool.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\where.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\bthudtask.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\CheckNetIsolation.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\diskperf.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ftp.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\help.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\label.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\makecab.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\expand.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\mavinject.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\msfeedssync.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\rekeywiz.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wlanext.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cmd.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\dfrgui.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\System32\DriverStore\FileRepository\kdnic.inf_amd64_a9d04a55194853d2\kdnicctrl.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\instnm.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ntprint.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\PresentationHost.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\WerFault.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ddodiag.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\dtdump.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\LaunchTM.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ntprint.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\sdiagnhost.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\tasklist.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\user.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\curl.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\gpresult.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\gpscript.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\mmc.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\msiexec.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\TpmInit.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\mode.com 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\msiexec.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Defender\NisSrv.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Media Player\wmprph.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Windows Media Player\setup_wm.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\show_third_party_software_licenses.bat- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\show_third_party_software_licenses.bat 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Windows Media Player\wmprph.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-winlogon-tools_31bf3856ad364e35_10.0.26100.1_none_91672235f58871de\wlrmdr.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-verclsid_31bf3856ad364e35_10.0.26100.1_none_c32f23e8b061a8a0\verclsid.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-lprportmonitor_31bf3856ad364e35_10.0.26100.1_none_b0f749e1a65b338a\lpr.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-upnpdevicehost_31bf3856ad364e35_10.0.26100.1591_none_67fcd9ee18eb970e\r\upnpcont.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..ommandline-dsdbutil_31bf3856ad364e35_10.0.26100.1_none_e06e3d007fa29525\dsdbutil.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cipher_31bf3856ad364e35_10.0.26100.1150_none_48fdcfd155028bbe\r\cipher.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..daryauthfactor-task_31bf3856ad364e35_10.0.26100.1150_none_67ed785bf55a7a21\r\DeviceCredentialDeployment.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ropertiesprotection_31bf3856ad364e35_10.0.26100.1_none_60a5ff2e85104e26\SystemPropertiesProtection.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SystemApps\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\XBox.TCUI.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ktmutil_31bf3856ad364e35_10.0.26100.1150_none_24714894b112c0f3\ktmutil.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lsa-minwin_31bf3856ad364e35_10.0.26100.1591_none_d92b9cc442553e63\lsass.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..oler-filterpipeline_31bf3856ad364e35_10.0.26100.1591_none_c76d94b08b6db4ab\r\printfilterpipelinesvc.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..native-whitebox-isv_31bf3856ad364e35_10.0.26100.1150_none_85392e759f939eae\r\RMActivate_isv.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ces-workspacebroker_31bf3856ad364e35_10.0.26100.1_none_8c35e9ae895560fc\wkspbroker.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegAsm.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_aspnet_compiler_b03f5f7f11d50a3a_4.0.15912.0_none_75b001d640e3113b\aspnet_compiler.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userdeviceregistration_31bf3856ad364e35_10.0.26100.1591_none_b519370a5498ebc4\r\dsregcmd.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft.windows.winhttp_31bf3856ad364e35_5.1.26100.1591_none_efe288270f8c9b0b\pacjsworker.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..tional-chinese-core_31bf3856ad364e35_10.0.26100.1591_none_ff98a305e55fa64a\IMTCLNWZ.EXE- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-openwith_31bf3856ad364e35_10.0.26100.1591_none_13357425571b7ed9\r\OpenWith.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.26100.1_none_a518656df7c165fb\SenseCM.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.26100.1150_none_3a3e93ee89e96c57\changepk.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_netfx4-aspnet_wp_exe_b03f5f7f11d50a3a_4.0.15912.0_none_107a08446d17dcf2\aspnet_wp.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-appidcore_31bf3856ad364e35_10.0.26100.1591_none_d4e57f099acc84e0\appidtel.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\r\CBS\SearchHost.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..eldebugger-recorder_31bf3856ad364e35_10.0.26100.1_none_6bac5cbeaae00b9d\ttdinject.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.26100.1591_none_0bc717c8ecd0287d\WerFault.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-admincmdtools_31bf3856ad364e35_10.0.26100.1150_none_50956d2d42f20d39\showmount.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..llshield-wow64-main_31bf3856ad364e35_10.0.26100.1_none_6b60acbaf3301f6c\_isdel.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-security-tokenbroker_31bf3856ad364e35_10.0.26100.1591_none_49c71cad8f03abe2\r\TokenBrokerCookies.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1738_none_48e47fdfbf0a33b1\TiWorker.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SystemApps\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\AssignedAccessLockApp.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_netfx35linq-addinutil_31bf3856ad364e35_10.0.26100.1_none_c811e1884be875a8\AddInUtil.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelReg.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..tional-chinese-core_31bf3856ad364e35_10.0.26100.1591_none_f543f8b3b0fee44f\IMTCPROP.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vssservice_31bf3856ad364e35_10.0.26100.1_none_57c076d780640e4c\VSSVC.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.26100.1150_none_664cc5d65cf1b4d8\winrm.cmd- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoftwindowssystemrestore-tasks_31bf3856ad364e35_10.0.26100.1_none_3182dffdaeb31123\SrTasks.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_vmconnect_31bf3856ad364e35_10.0.26100.1591_none_2bf6278ffa2525b6\r\vmconnect.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rundll32_31bf3856ad364e35_10.0.26100.1591_none_73c54cb65af16a28\r\rundll32.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..cquisition-wiawow64_31bf3856ad364e35_10.0.26100.1150_none_686748f1a08de9d9\r\wiawow64.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..ckgroundmediaplayer_31bf3856ad364e35_10.0.26100.1150_none_57cd52b05a092c6e\Windows.Media.BackgroundPlayback.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-storage-diagnostics_31bf3856ad364e35_10.0.26100.1591_none_10714fc4b84d2612\stordiag.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.26100.1591_none_069d7eb507aa0068\r\SearchProtocolHost.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-control_31bf3856ad364e35_10.0.26100.1_none_a0b44bf0476b30ed\control.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\splwow64.exe 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fontview_31bf3856ad364e35_10.0.26100.1150_none_e04b5db66660ee87\r\fontview.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-htmlapplication_31bf3856ad364e35_11.0.26100.1_none_8a3f1279dcc4073c\mshta.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pnputil_31bf3856ad364e35_10.0.26100.1591_none_9923bdb86c8e5db2\pnputil.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..on-filedialogbroker_31bf3856ad364e35_10.0.26100.1150_none_76334e5b2ee0ae62\r\FileDialogBroker.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-synchost_31bf3856ad364e35_10.0.26100.1_none_70c95fcb997fc363\SyncHost.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mspaint_31bf3856ad364e35_10.0.26100.1150_none_2a04d71b9e7ba19d\r\mspaint.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-eduprintprov_31bf3856ad364e35_10.0.26100.1150_none_4d28a605d2d4d62b\EduPrintProv.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.26100.1591_none_0f19119bcdcaf335\r\SpeechModelDownload.exe- 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-23_e657d419efdd21fa16bbfd76ea4b1fc5_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5336
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 11.8MB
- SHA256 3cf5185c7b81f76cda232aea719caa5a01b15e2098669c5fb7bfeb9493bf08bd
- MD5 87c1d94519cee4a7ade1040f3ed02ee8
- SHA1 adf540f464bc62ab39f8dbcd51863ea22698bc39
- SHA512 aaee72f1f76865d62893c6015b1707ca4353b9571e1e089cff5592bf254d0059a8a162dfee65d796c6272f3eb4a43d007b1370b39c253431637f166ede020461
- SSDEEP 196608:8pAnjOyAdOrfyKmd0jdBVoDco1EU8I4PJF:OAnBqrv1EU8I4
- TLSH T172C69D16F2A44376D0B3C078C9969766EB713C590770C6DB2284B7E92F33BD1A63A721
- MD5 SHA1 SHA512 SSDEEP TLSH