Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
24/08/2026, 23:38
Behavioral task
behavioral1
Sample
2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe
- Size 20.7MB
- Sample260824-3m4nwavejd
- SHA256 27a808feae9c90780d2f81046806b38b4d6bf9d0f1195bcac9a843f8e9651f8f
- MD5 d6b62961c0a2dde9fe112d97f7187fdd
- SHA1 3d7fe55d0741395cc965d1f275c302e3d4e29ade
- SHA512 3ddb03cbc9a6d8916157d62f222d9f478c6a5148ca91135a3f34347cd0d20d596ae60af7bfd7cfc26dffe6e708a85e4733c05d14faafb076112162cec2d479e2
- SSDEEP 196608:WpAnjOyAdOrNTfgd7ozqdMcItozjrOOwH+v2gTH2qBpu1QfLIqsufr:sAntROVzjrOB+NTHNBpu1Qfc0r
- TLSH T1FC27491122D58FE9C05FD034CE4626B196237C5A8F719BDF2980BE693E726E06E3521F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral1/files/0x00260000000243cc-5.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral1/files/0x00260000000243cc-5.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule behavioral1/files/0x00260000000243cc-5.dat UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\fsquirt.exe 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\netsh.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\printui.exe 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\regsvr32.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\cleanmgr.exe 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\dplaysvr.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\mfpmp.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\OposHost.exe 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\PresentationHost.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\provlaunch.exe 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\print.exe 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\whoami.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\compact.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\dccw.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\diskpart.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\mshta.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\regini.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\wlanext.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\colorcpl.exe 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\format.com 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\gpupdate.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\regedit.exe 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\dxdiag.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\PickerHost.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\RMActivate.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\WWAHost.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\xcopy.exe 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\iscsicli.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\logman.exe 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\PING.EXE- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\RdpSa.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\xcopy.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\cmdl32.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\SearchIndexer.exe 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\Windows.WARP.JITService.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\dvdplay.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\iexpress.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\mode.com- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\PkgMgr.exe 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\SndVol.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\write.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\curl.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\certutil.exe 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\dllhost.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\grpconv.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\MRINFO.EXE- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\netbtugc.exe 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\psr.exe 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\SettingSyncHost.exe 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\sfc.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\typeperf.exe 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SysWOW64\eventcreate.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe -
resource yara_rule behavioral1/memory/2412-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/files/0x00260000000243cc-5.dat upx behavioral1/memory/2412-334-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/2412-3216-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Windows Media Player\wmlaunch.exe 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\7-Zip\Uninstall.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Internet Explorer\ielowutil.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{26DAE493-BB25-4AFA-A100-0B8EFB02FE62}\MicrosoftEdge_X64_139.0.3405.125.exe 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Internet Explorer\iexplore.exe 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Windows Mail\wab.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{26DAE493-BB25-4AFA-A100-0B8EFB02FE62}\MicrosoftEdge_X64_139.0.3405.125.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-wifinetworkmanager_31bf3856ad364e35_10.0.19041.84_none_6461f879a9c4a23e\f\wifitask.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\x86_addinprocess32_b77a5c561934e089_10.0.19041.1_none_dae2223cd3e6f926\AddInProcess32.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..diagnostic-schedule_31bf3856ad364e35_10.0.19041.1_none_49c7a9c019150ac4\MdSched.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-notepad_31bf3856ad364e35_10.0.19041.1081_none_e3f87355251e8c43\f\notepad.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.19041.1_none_fc9bfaeba32d6cd5\dpnsvr.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ieframe_31bf3856ad364e35_11.0.19041.1288_none_1d22271c8cc35d4b\r\IESettingSync.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..nt-enrollmenthelper_31bf3856ad364e35_10.0.19041.1_none_f0bba0af1c8d1f56\PinEnrollmentBroker.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-autofmt_31bf3856ad364e35_10.0.19041.1266_none_650ebab5a8c02ffc\r\autofmt.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wpd-shellextension_31bf3856ad364e35_10.0.19041.1266_none_90436a82b05bca89\WPDShextAutoplay.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-openwith_31bf3856ad364e35_10.0.19041.1_none_2311dc3012116c15\OpenWith.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-photoscreensaver_31bf3856ad364e35_10.0.19041.1_none_21bf8c5bf7d38604\PhotoScreensaver.scr- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..hreshold-adminflows_31bf3856ad364e35_10.0.19041.1023_none_9583d52fd3076014\r\SystemSettingsAdminFlows.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..raries-servercommon_31bf3856ad364e35_10.0.19041.906_none_9204c42a031e28cf\iissetup.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cloudnotifications_31bf3856ad364e35_10.0.19041.1_none_47f8a965309a7ee6\CloudNotifications.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-os-kernel_31bf3856ad364e35_10.0.19041.1288_none_e0f8082a6952ce81\f\ntoskrnl.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.19041.746_none_476e348ff3b593af\cmmon32.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-csp_31bf3856ad364e35_10.0.19041.844_none_c606f47e6aa94b5b\r\hvsievaluator.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..switch-toasthandler_31bf3856ad364e35_10.0.19041.746_none_a89196e695076787\f\InputSwitchToastHandler.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-upnpdevicehost_31bf3856ad364e35_10.0.19041.867_none_9fcce199936290f4\r\upnpcont.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wordpad_31bf3856ad364e35_10.0.19041.1202_none_a27aa61d221bdc5c\f\wordpad.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-infdefaultinstall_31bf3856ad364e35_10.0.19041.1_none_228591433b6cf074\InfDefaultInstall.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-provisioning-core_31bf3856ad364e35_10.0.19041.844_none_95c651508e565d13\r\provtool.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.19041.1288_none_3f2d1be96237886e\r\wsmprovhost.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..switch-toasthandler_31bf3856ad364e35_10.0.19041.746_none_b2e64138c9682982\f\InputSwitchToastHandler.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.264_none_0e32f443c4669fed\f\hvax64.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-omadmclient_31bf3856ad364e35_10.0.19041.1151_none_c86feb6936a97173\f\omadmclient.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..omerfeedbackmanager_31bf3856ad364e35_10.0.19041.1_none_9224c91b2d8eed57\imecfmui.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-recover_31bf3856ad364e35_10.0.19041.1_none_3c045b5253f885ed\recover.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-mbr2gpt_31bf3856ad364e35_10.0.19041.84_none_ee550b91ec0a7e82\r\MBR2GPT.EXE- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unp_31bf3856ad364e35_10.0.19041.1266_none_21c0be7c0dad3632\UNPUXHost.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.19041.1_none_3d62a57d3b12dcf1\mode.com- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.19041.1_none_330dfb2b06b21af6\doskey.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sethc_31bf3856ad364e35_10.0.19041.746_none_40b989c5d3ea9316\r\sethc.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wusa_31bf3856ad364e35_10.0.19041.1151_none_21d0a68ccdc67be8\wusa.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-autochk_31bf3856ad364e35_10.0.19041.1266_none_610e6b21ab533b13\autochk.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.19041.746_none_816403dd2374fa29\r\dfrgui.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.19041.1_none_1f65f7473443d565\cmmon32.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..l-systemuwplauncher_31bf3856ad364e35_10.0.19041.1_none_bafc9f61651f37d2\SystemUWPLauncher.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fileexplorer.appxmain_31bf3856ad364e35_10.0.19041.546_none_476476bb5c3a0bbc\FileExplorer.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_10.0.19041.1_none_5d525a67aae579a5\dpnsvr.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess.exe 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..iodatamodel-library_31bf3856ad364e35_10.0.19041.264_none_52f277f293540161\WinBioDataModelOOBE.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-eventcollector_31bf3856ad364e35_10.0.19041.662_none_e341f52007f6d1a8\wecutil.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..tional-chinese-core_31bf3856ad364e35_10.0.19041.1_none_19c9b562d4b65581\IMTCLNWZ.EXE- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tapisetup_31bf3856ad364e35_10.0.19041.1_none_2a38e2996ee84e57\TapiUnattend.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..oler-filterpipeline_31bf3856ad364e35_10.0.19041.867_none_099246ae3a45708c\r\printfilterpipelinesvc.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-pickerhost_31bf3856ad364e35_10.0.19041.1_none_6df323382219b604\PickerHost.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\x86_netfx-ngen_exe_b03f5f7f11d50a3a_10.0.19041.1_none_38a57ff5dba3c9f4\ngen.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\SystemApps\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\XBox.TCUI.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_10.0.19041.928_none_6012c8cabf808ff7\f\pcaui.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-certificateinstall_31bf3856ad364e35_10.0.19041.1_none_efa641d58a943e71\dmcertinst.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ing-management-core_31bf3856ad364e35_10.0.19041.1_none_e1253388ca1ca1af\DismHost.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wslhost_31bf3856ad364e35_10.0.19041.117_none_9be21f0ef860b570\r\wslhost.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_10.0.19041.746_none_5fb37340a423d88f\PrintBrm.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_multipoint-logcollector_31bf3856ad364e35_10.0.19041.1_none_56138d203a7fc4cf\LogCollector.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-usoclient_31bf3856ad364e35_10.0.19041.1266_none_23ae8c0349f1b325\r\UsoClient.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_10.0.19041.1_none_4247919c34819e8e\pcaui.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.19041.1266_none_f5ba41fece31d7fe\SpatialAudioLicenseSrv.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-surrogate-core_31bf3856ad364e35_10.0.19041.546_none_12e3d70535675c5f\dllhost.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-adminservice_31bf3856ad364e35_10.0.19041.906_none_388c7870566ba06d\WMSvc.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.19041.1151_none_f68db62a3702882b\SearchProtocolHost.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..eldebugger-recorder_31bf3856ad364e35_10.0.19041.1_none_1a55178fad503598\ttdinject.exe- 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-24_d6b62961c0a2dde9fe112d97f7187fdd_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2412
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 21.2MB
- SHA256 5570df7f920f76dddea1f412b49f51a9621256b6882fe128b213061e9ccbc4a5
- MD5 6e627458bdb6ceea6afee6a4ee6ac7d0
- SHA1 e5df73781403ffc3cf00f0dc2bf130071fb730dd
- SHA512 8ca547bff3105fea2f1ddb240190d8b8539f6748b56ee7c83b2acb2f2745f541e3570e3d1280c5ee8346b378eaedd424bba8247e4431fc7f6f8392abe376892f
- SSDEEP 196608:WpAnjOyAdOrNTfgd7ozqdMcItozjrOOwH+v2gTH2qBpu1QfLIqsufnoK:sAntROVzjrOB+NTHNBpu1Qfc0oK
- TLSH T1C7275A1132D58FA9C05FD034CE4626A196237C5A8F719FDF2980BE693E726E06E3521F
- MD5 SHA1 SHA512 SSDEEP TLSH