Analysis
- max time kernel
100s - max time network
130s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/08/2026, 09:27
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-27_be46323cd1d0acbb14b1b17278a7c541_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-27_be46323cd1d0acbb14b1b17278a7c541_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-08-27_be46323cd1d0acbb14b1b17278a7c541_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
- Size 3.3MB
- Sample260827-le7bcs1was
- SHA256 6129ab192ba66502c36ec1deab084d31fd9fad4f645b81c8a41f9fa2c3e06254
- MD5 be46323cd1d0acbb14b1b17278a7c541
- SHA1 3097a547420bfbef8859b5e298616eaa7384a7dd
- SHA512 0e355b0e6bf767ffd98a409faf4ab5bb9be84bdd4f4b90e937054be5f9d78bab35f60c9636f11e41e8febb0c193acfa44900512610f7cdefdd8bab7aaaaf526f
- SSDEEP 49152:4x2aoLfUtv9M1oJdXN0BMOwLloBrugXIgek056rapYq:U9XJdXN0B7+s/ekRra6
- TLSH T1CBF57E2376A48D71E07B85748991A735D6727C210F2287CBE258BB1D2D337D2AD3A723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 8 IoCs
resource yara_rule behavioral2/memory/5744-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c57a-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2f2-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c9c-1264.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b6ff-1751.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b713-1750.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5744-1962-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1292-1975-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack - Executes dropped EXE 1 IoCs
pid Process 1292 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-27_be46323cd1d0acbb14b1b17278a7c541_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-27_be46323cd1d0acbb14b1b17278a7c541_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe 2026-08-27_be46323cd1d0acbb14b1b17278a7c541_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-08-27_be46323cd1d0acbb14b1b17278a7c541_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-08-27_be46323cd1d0acbb14b1b17278a7c541_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-08-27_be46323cd1d0acbb14b1b17278a7c541_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe$ patcher.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-08-27_be46323cd1d0acbb14b1b17278a7c541_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe$ 2026-08-27_be46323cd1d0acbb14b1b17278a7c541_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe$ 2026-08-27_be46323cd1d0acbb14b1b17278a7c541_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-08-27_be46323cd1d0acbb14b1b17278a7c541_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe$ patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe patcher.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-08-27_be46323cd1d0acbb14b1b17278a7c541_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe$ 2026-08-27_be46323cd1d0acbb14b1b17278a7c541_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe$ 2026-08-27_be46323cd1d0acbb14b1b17278a7c541_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$ 2026-08-27_be46323cd1d0acbb14b1b17278a7c541_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE$ 2026-08-27_be46323cd1d0acbb14b1b17278a7c541_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe$ 2026-08-27_be46323cd1d0acbb14b1b17278a7c541_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-08-27_be46323cd1d0acbb14b1b17278a7c541_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\7-Zip\7zFM.exe 2026-08-27_be46323cd1d0acbb14b1b17278a7c541_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe$ 2026-08-27_be46323cd1d0acbb14b1b17278a7c541_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe patcher.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe 2026-08-27_be46323cd1d0acbb14b1b17278a7c541_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-27_be46323cd1d0acbb14b1b17278a7c541_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-08-27_be46323cd1d0acbb14b1b17278a7c541_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$ patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe 2026-08-27_be46323cd1d0acbb14b1b17278a7c541_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-27_be46323cd1d0acbb14b1b17278a7c541_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-27_be46323cd1d0acbb14b1b17278a7c541_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe 2026-08-27_be46323cd1d0acbb14b1b17278a7c541_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-27_be46323cd1d0acbb14b1b17278a7c541_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe 2026-08-27_be46323cd1d0acbb14b1b17278a7c541_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe 2026-08-27_be46323cd1d0acbb14b1b17278a7c541_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe 2026-08-27_be46323cd1d0acbb14b1b17278a7c541_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-27_be46323cd1d0acbb14b1b17278a7c541_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-27_be46323cd1d0acbb14b1b17278a7c541_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-08-27_be46323cd1d0acbb14b1b17278a7c541_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe 2026-08-27_be46323cd1d0acbb14b1b17278a7c541_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-27_be46323cd1d0acbb14b1b17278a7c541_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-27_be46323cd1d0acbb14b1b17278a7c541_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-27_be46323cd1d0acbb14b1b17278a7c541_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe 2026-08-27_be46323cd1d0acbb14b1b17278a7c541_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe 2026-08-27_be46323cd1d0acbb14b1b17278a7c541_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-27_be46323cd1d0acbb14b1b17278a7c541_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-08-27_be46323cd1d0acbb14b1b17278a7c541_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-08-27_be46323cd1d0acbb14b1b17278a7c541_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-27_be46323cd1d0acbb14b1b17278a7c541_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-27_be46323cd1d0acbb14b1b17278a7c541_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-08-27_be46323cd1d0acbb14b1b17278a7c541_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-08-27_be46323cd1d0acbb14b1b17278a7c541_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-27_be46323cd1d0acbb14b1b17278a7c541_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-27_be46323cd1d0acbb14b1b17278a7c541_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5744 2026-08-27_be46323cd1d0acbb14b1b17278a7c541_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe 1292 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-27_be46323cd1d0acbb14b1b17278a7c541_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-27_be46323cd1d0acbb14b1b17278a7c541_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5744
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1292
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 3.3MB
- SHA256 6129ab192ba66502c36ec1deab084d31fd9fad4f645b81c8a41f9fa2c3e06254
- MD5 be46323cd1d0acbb14b1b17278a7c541
- SHA1 3097a547420bfbef8859b5e298616eaa7384a7dd
- SHA512 0e355b0e6bf767ffd98a409faf4ab5bb9be84bdd4f4b90e937054be5f9d78bab35f60c9636f11e41e8febb0c193acfa44900512610f7cdefdd8bab7aaaaf526f
- SSDEEP 49152:4x2aoLfUtv9M1oJdXN0BMOwLloBrugXIgek056rapYq:U9XJdXN0B7+s/ekRra6
- TLSH T1CBF57E2376A48D71E07B85748991A735D6727C210F2287CBE258BB1D2D337D2AD3A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe
- Size 3.4MB
- SHA256 9663b1f2ca8f612ce8149593f5e4f736e4904815b1d08dcaede6970b65c0e89d
- MD5 ac668a0745e7d1f8c2e3a95197741af7
- SHA1 43d633509b28a178914bbdf423f2653b56bb5b98
- SHA512 65bf3d1b5e050dfc4f42dbec8987f373a66426ff1162b80ec93e8c9753909d6dc2a735963fd4c3b2e0d414cbd096e4d03f8fcb812d265057accbad60b3cdbb82
- SSDEEP 49152:4x2aoLfUtv9M1oJdXN0BMOwLloBrugXIgek056rapYqdw:U9XJdXN0B7+s/ekRra6L
- TLSH T13DF57E2376A48D71E07B85748991A735D6727C210F2287CBE258BB1D2D337D2AD3A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe$
- Size 4.1MB
- SHA256 94ad5feb4158072b5be200981d020e57436dcf60e408b6ba6f79e87a45e6e966
- MD5 46b0407c470a0e4c80f22eec069cc30c
- SHA1 3bd8963de91c534d439af520fec0b1173201c258
- SHA512 bf28a3711ff35b0e7145d604f8520e8e363885e577220c3a822e79a0698ca33e0461e969da25163c38eeef55dd8431b0009725bde073e977b1cd743531bb15b1
- SSDEEP 98304:U9XJdXN0B7+s/ekRra6QMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMZMMMqNMMzMa:U6ekFa69
- TLSH T1AA167D13B7A48971E07B45708962A735D6727C210F2287CBB258BB1D2D337D2AD3A727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 3.8MB
- SHA256 4966f1e9dd2e4690c44ca6ac9641a02a1bd044600c280ef88be70e1f2355aa09
- MD5 0304a6bb9465e3072e2bebce67d22dee
- SHA1 7733e427376e88a61cc61233388de8c656e521fb
- SHA512 b6c6c956615b734bda1665ba9159559ac30d75d6f684f0bd67f432432c1750b9ed5e34b763fe045e64d58a6fa04358b27a53f1e73e507278fbef587d64214d1e
- SSDEEP 49152:4x2aoLfUtv9M1oJdXN0BMOwLloBrugXIgek056rapYqjPji0Aj:U9XJdXN0B7+s/ekRra6Gjo
- TLSH T12B167D23B6A48A71D0778475C592A775D6327C210F3187CBA258BB2D2E337D2993A733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe$
- Size 3.4MB
- SHA256 6178b7dde6b8e203ab9e98ece93dfb12131f9426a3d99d7a27f7cc85f392d4f4
- MD5 6f4e0b35447336e3608ce04ee0c7cdeb
- SHA1 5795396ce5b5c12f81e1da72f62162f446a7c394
- SHA512 e50224087b8266973b6ed9e2417f05647ee46bea7cabe3e6b58fb5b1856848170573bd98964ab394b824575e35f3c2b9d6d3f8c6b75f91c035a9c28443225e17
- SSDEEP 49152:4x2aoLfUtv9M1oJdXN0BMOwLloBrugXIgek056rapYqt:U9XJdXN0B7+s/ekRra6Y
- TLSH T1ADF57E13B6A48D71E07B85708951A735D6327D210F2287CBE258BB2D6D337D2AD3A723
- MD5 SHA1 SHA512 SSDEEP TLSH