Analysis
- max time kernel
148s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/08/2026, 06:58
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
- Size 5.5MB
- Sample260825-hrycfagb87
- SHA256 247fba1c264915da717bc491840826ceabdcaf7fca89dd37538622a0d2cb845a
- MD5 97c3a6bf81bbcc338e3333042816e56e
- SHA1 09f21020566946a38a748e3d0252f8dffcb8f2af
- SHA512 b22551902126bb30fa11931b5640ba0d88659ab377570958d871cf2211b6aad2bbba98e9ad39e2714fc5ff8a98483efb8191be7f5be0e21600e1b3b7441a0590
- SSDEEP 49152:kpPZuyWSG+BBvGvnjOyYVGlqRONszVBXdc/RJzVBXfqJtb2Ib+Cq99LyFpYqlVBV:khpBinjOykGcPdOR5fd46UdB6w
- TLSH T139469D16F2904276D0B3D079C5EA5755EA7134A91B30D3DB3388F2692E337D29A3A732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule behavioral2/files/0x000e000000016cdc-4.dat UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\dxdiag.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\OposHost.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\srdelayed.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wevtutil.exe 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\PresentationHost.exe 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\rasautou.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\schtasks.exe 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SearchIndexer.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\verifiergui.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\appidtel.exe 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\powercfg.exe 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\unregmp2.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Utilman.exe 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cmmon32.exe 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\gpresult.exe 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\edpnotify.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\getmac.exe 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\gpscript.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\mountvol.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\netiougc.exe 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\rundll32.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SyncHost.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\TSTheme.exe 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\finger.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\mcbuilder.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\regsvr32.exe 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\setx.exe 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wextract.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\gpresult.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\iexpress.exe 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\msfeedssync.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\NETSTAT.EXE 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\systeminfo.exe 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ByteCodeGenerator.exe 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\chcp.com- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cmd.exe 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\dpapimig.exe 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\extrac32.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\iscsicli.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\TapiUnattend.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Fondue.exe 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\mstsc.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\raserver.exe 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\WerFault.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\icacls.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\net1.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\netsh.exe 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\systray.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\curl.exe 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\msra.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\recover.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SecEdit.exe 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cttune.exe 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Mozilla Firefox\updater.exe 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\show_third_party_software_licenses.bat 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseTVM.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Media Player\setup_wm.exe 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{442E2BAB-89E2-4A69-94D2-35EFF397FE54}\MicrosoftEdge_X64_139.0.3405.125.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ment-userdatasource_31bf3856ad364e35_10.0.26100.1150_none_01782765ebe4af77\r\UserDataSource.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printdialog.appxmain_31bf3856ad364e35_10.0.26100.1591_none_20d2a02f892fa68f\r\PrintDialog.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_multipoint-wmsselfhealingsvc_31bf3856ad364e35_10.0.26100.1150_none_17cfd41bb43a934d\WmsSelfHealingSvc.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_bsdtar_31bf3856ad364e35_10.0.26100.1150_none_f2155cb81beac176\r\tar.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-csvde_31bf3856ad364e35_10.0.26100.1150_none_f7257bce926ea30a\r\csvde.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-omadmclient_31bf3856ad364e35_10.0.26100.1591_none_ef5fd1803186a7fb\omadmclient.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-safedocs-main_31bf3856ad364e35_10.0.26100.1591_none_c0c9b77316cf6b10\sdclt.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\msil_hyperv-ux-ui-vmimport_31bf3856ad364e35_10.0.26100.1_none_22104f68acb76d7f\VMImport.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-international-unattend_31bf3856ad364e35_10.0.26100.1591_none_662e67cdd2014bd1\r\MuiUnattend.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\x86_microsoft-windows-b..onment-dvd-etfsboot_31bf3856ad364e35_10.0.26100.1_none_2350f58e1a989738\etfsboot.com- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\DeploymentAgent.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.26100.1742_none_d23b4ab50f085fd0\r\vmms.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-corruptedfilerecovery_31bf3856ad364e35_10.0.26100.1_none_84ad60409153e8ea\cofire.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..rvices-adam-install_31bf3856ad364e35_10.0.26100.1150_none_b8bbaaa483060b58\r\adamuninstall.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.26100.1150_none_3a3e93ee89e96c57\phoneactivate.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-terminalservices-theme_31bf3856ad364e35_10.0.26100.1150_none_71cd60532ab93f47\r\TSTheme.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..rvices-sessionagent_31bf3856ad364e35_10.0.26100.1_none_829a5953e9a4b444\RdpSa.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.26100.1591_none_68327241782dd35b\SyncAppvPublishingServer.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-gdi_31bf3856ad364e35_10.0.26100.1591_none_4593139f0a8d3490\fontdrvhost.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.26100.1301_none_22d8cfb46252dd83\WDAGNetDiag.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ndation-frameserver_31bf3856ad364e35_10.0.26100.1591_none_5181bbfe74a17a20\r\FsIso.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.26100.1150_none_fb078fe8106f7572\cmmon32.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_ce938c0efedcde06\NETSTAT.EXE- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wusa_31bf3856ad364e35_10.0.26100.1_none_b448e42fb58a37ac\wusa.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\BrowserCore\BrowserCore.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_compiler.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pcwdiagnostic_31bf3856ad364e35_10.0.26100.1591_none_90ebc90aafaeeb97\pcwrun.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pcwdiagnostic_31bf3856ad364e35_10.0.26100.1591_none_90ebc90aafaeeb97\r\pcwrun.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-web-app-host_31bf3856ad364e35_10.0.26100.1_none_2f836f38379760e2\WWAHost.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..tional-chinese-core_31bf3856ad364e35_10.0.26100.1591_none_ff98a305e55fa64a\IMTCPROP.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.26100.1591_none_986ba09695018480\r\UevAppMonitor.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devicecensus_31bf3856ad364e35_10.0.26100.1591_none_4b326ab0aa8da2bf\DeviceCensus.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-commandprompt_31bf3856ad364e35_10.0.26100.1591_none_31216c35fec422ae\cmd.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.26100.1_none_686bcd839bc27ad8\tracerpt.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess32.exe 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-label_31bf3856ad364e35_10.0.26100.1_none_5422b42832d51a31\label.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_10.0.26100.1591_none_2204fa419ae7b594\msinfo32.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userinit_31bf3856ad364e35_10.0.26100.1591_none_77e8b53c81b6cf4f\r\userinit.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\x86_msbuild_b03f5f7f11d50a3a_10.0.26100.1_none_2572c0d564c128f3\MSBuild.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-dtc-runtime_31bf3856ad364e35_10.0.26100.1150_none_b53a535c0fece405\msdtc.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dpapi-keys_31bf3856ad364e35_10.0.26100.1_none_7ac67b5c35fd6e5c\dpapimig.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-more_31bf3856ad364e35_10.0.26100.1_none_a94df8cb819b49c2\more.com- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..pertiescomputername_31bf3856ad364e35_10.0.26100.1_none_2d66dab1a4ca9883\SystemPropertiesComputerName.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\WsatConfig.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sudo_31bf3856ad364e35_10.0.26100.1_none_a2b1ee1b85e5539a\sudo.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devicecensus_31bf3856ad364e35_10.0.26100.1591_none_4b326ab0aa8da2bf\r\DeviceCensus.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iscsi_initiator_ui_31bf3856ad364e35_10.0.26100.1150_none_73d27b280bfbc7a7\iscsicpl.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-robocopy_31bf3856ad364e35_10.0.26100.1591_none_62c72aa79c6b13fd\Robocopy.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-synchost_31bf3856ad364e35_10.0.26100.1150_none_05685d8fac7c4f66\r\SyncHost.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dxp-deviceexperience_31bf3856ad364e35_10.0.26100.1150_none_e30c7c3aa9b12724\Dxpserver.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-unifiedwritefilter_31bf3856ad364e35_10.0.26100.1591_none_37fa9a7337d181ee\UwfServicingSvc.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-clientcmdtools_31bf3856ad364e35_10.0.26100.1150_none_ed4ab399a05c1619\mount.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-timeout_31bf3856ad364e35_10.0.26100.1_none_895815212ed14bd2\timeout.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\CBS\DesktopStickerEditorWin32Exe\DesktopStickerEditorWin32Exe.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_windows-defender-service_31bf3856ad364e35_10.0.26100.1_none_c299cb2ebf592e77\MpDlpService.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe- 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-24_97c3a6bf81bbcc338e3333042816e56e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5048
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 6.5MB
- SHA256 23fefba26aefa5bfc319c70dfc763c3851483ae9c162629a26d9792302a4553b
- MD5 9fe2672b6fb3eca5cc808e47f46e8466
- SHA1 d6053714204d24ff6476fb50c5d9b5c2c25a2454
- SHA512 f88e52fb6b2d92756e566b689e386e50bfa7853420a18501377f78a9aedc55aa6cabf8136abe97c986ef3a51d22f8ae59b607f5ad2ec67087d060b0f47c476e0
- SSDEEP 98304:khpBinjOykGcPdOR5fd46UdB6hezSC6v2XMHT:8pAnjOyAdOrf26UdB6Wg
- TLSH T111667C16F2644377D0B3D0B9C5E66755EA7234651B30C6CB2389F26D2E237E28A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH