Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/09/2026, 08:12
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
- Size 9.8MB
- Sample260909-j384rabf47
- SHA256 7f8227e3ab08bac31ec5ecf1ecaad511c6153d376b89e4e1dd249723456c8bcd
- MD5 02213cb8497ecf09eeeb83f04f1c104b
- SHA1 3f191ce242b6ae7e87ff01ac3872cd9ff6d864d2
- SHA512 79a12d83e18a50d22f038eb951df7efb947cf78b9ff1818c04d8dafe60dacb4706a9a5acb26e931196bd3b9a0148760d2ae2c8c4d3b70f7cd470011b4cff8e5c
- SSDEEP 98304:khpBinjOykGcIy6fnUm8UdjoG0oAaldmdmnpT6dnUm8UTT:8pAnjOyny6f18UZorKmd0V6d18UTT
- TLSH T1C1A68D12F29442B6D066C075CA969365EB313C590BB1D6EF3280B7D92E33BD17B3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule behavioral2/files/0x0010000000016cb6-4.dat UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\cmstp.exe 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\mstsc.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\charmap.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\clip.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cmd.exe 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\msinfo32.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\mspaint.exe 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\sxstrace.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SystemUWPLauncher.exe 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\charmap.exe 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cliconfg.exe 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\lodctr.exe 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\net.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\winrm.cmd 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\WWAHost.exe 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\iscsicli.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\grpconv.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SecEdit.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\sfc.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\sudo.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wscript.exe 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\chkntfs.exe 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\dllhost.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\fc.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\iscsicpl.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\sdbinst.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\upnpcont.exe 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cttune.exe 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\eventcreate.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\OpenWith.exe 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wermgr.exe 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ktmutil.exe 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\makecab.exe 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\net1.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\RMActivate.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\setx.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\MuiUnattend.exe 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\sdchange.exe 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\sethc.exe 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\subst.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\WWAHost.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\esentutl.exe 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\label.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\RdpSa.exe 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\dcomcnfg.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ktmutil.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\NETSTAT.EXE 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\raserver.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\systeminfo.exe 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\TRACERT.EXE- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\autofstx.exe 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Windows Media Player\setup_wm.exe 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Windows Media Player\wmplayer.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Defender\MpDefenderCoreService.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\dotnet\dotnet.exe 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvsystem_31bf3856ad364e35_10.0.26100.1150_none_e501748828a1adac\AppVClient.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-explorer_31bf3856ad364e35_10.0.26100.1591_none_ed74a23929c34603\r\explorer.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.26100.1591_none_d3181252b1eca58b\msra.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_multimedia-rrinstaller_31bf3856ad364e35_10.0.26100.1150_none_aed4fccd3d3ea792\r\rrinstaller.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-muicachebuilder_31bf3856ad364e35_10.0.26100.1_none_2154eeee51c5b168\mcbuilder.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-csvde_31bf3856ad364e35_10.0.26100.1150_none_f7257bce926ea30a\csvde.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..devicescontrolpanel_31bf3856ad364e35_10.0.26100.1150_none_c0871c4af90b9611\r\ImagingDevices.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-newdev_31bf3856ad364e35_10.0.26100.1_none_18be9e06ed967433\newdev.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.26100.1742_none_4a8c1df49b9afb5a\r\Taskmgr.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..setup-compatibility_31bf3856ad364e35_10.0.26100.1150_none_0c098ad82e53afc9\NetCfgNotifyObjectHost.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-os-kernel_31bf3856ad364e35_10.0.26100.1742_none_07d5a4b5643ebc7c\ntoskrnl.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_regasm_b03f5f7f11d50a3a_10.0.26100.1_none_73a69603b491b174\RegAsm.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nbtstat_31bf3856ad364e35_10.0.26100.1150_none_39f7d4e8ce48dadd\nbtstat.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-secedit_31bf3856ad364e35_10.0.26100.1_none_abdad67b1a4b2829\SecEdit.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_multipoint-wmsuseragent_31bf3856ad364e35_10.0.26100.1150_none_fcc2db11075b9319\r\WmsUserAgent.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_netfx-applaunch_exe_b03f5f7f11d50a3a_10.0.26100.1_none_21c930510a00a526\AppLaunch.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SystemApps\Microsoft.Windows.AppResolverUX_cw5n1h2txyewy\AppResolverUX.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\OOBENetworkConnectionFlow.exe 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_aspnet_regsql_b03f5f7f11d50a3a_4.0.15912.355_none_a2d78d0e147c4763\aspnet_regsql.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-pnp-drvinst_31bf3856ad364e35_10.0.26100.1591_none_f11dd8b719f1a6f5\r\drvinst.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.26100.1_none_686bcd839bc27ad8\logman.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..sionagent-uachelper_31bf3856ad364e35_10.0.26100.1_none_c2022b2202ac5e56\RdpSaUacHelper.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.26100.1455_none_a73031e9ff1c7610\r\wmpshare.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.26100.1591_none_37c9b95250fac754\r\perfmon.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.26100.1591_none_86d079db2c05e448\r\SysResetErr.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wifinetworkmanager_31bf3856ad364e35_10.0.26100.1591_none_087ed6682bae0fd0\r\wifitask.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_regsvcs_b03f5f7f11d50a3a_4.0.15912.0_none_47183375504a1255\RegSvcs.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..rvices-sessionagent_31bf3856ad364e35_10.0.26100.1_none_829a5953e9a4b444\RdpSa.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-help-client_31bf3856ad364e35_10.0.26100.1591_none_07d88b48de1d8831\HelpPane.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vssadmin_31bf3856ad364e35_10.0.26100.1150_none_6064a5e6e18d90dc\vssadmin.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.26100.1_none_fcf0e4a9852b11e5\sftp.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..tional-chinese-core_31bf3856ad364e35_10.0.26100.1591_none_ff98a305e55fa64a\r\IMTCLNWZ.EXE- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_4fd441a3f30753ec\find.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regiis.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.26100.1150_none_fd0acb47aebf06db\diskperf.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-runonce_31bf3856ad364e35_10.0.26100.1591_none_bbcf7a15a36f8b3f\runonce.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-iexpress_31bf3856ad364e35_11.0.26100.1150_none_441b414b1810724c\r\wextract.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deploymentcsps_31bf3856ad364e35_10.0.26100.1150_none_09f77181ae5e3bb1\deploymentcsphelper.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-livecaptionsstub_31bf3856ad364e35_10.0.26100.1150_none_09962246afa36462\LiveCaptions.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-recoverydrive_31bf3856ad364e35_10.0.26100.1591_none_c452ac383bb44c33\r\RecoveryDrive.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.26100.1_none_a518656df7c165fb\SenseCE.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-thumbexthost_31bf3856ad364e35_10.0.26100.1_none_f7b54b8cda580fc5\ThumbnailExtractionHost.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\WebExperienceHostApp.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devicecensus_31bf3856ad364e35_10.0.26100.1591_none_4b326ab0aa8da2bf\DeviceCensus.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_7a109607cfe12f00\subst.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msmq-triggers-service_31bf3856ad364e35_10.0.26100.1591_none_c3e67f006d0c06f6\mqtgsvc.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-klist_31bf3856ad364e35_10.0.26100.1_none_3e2848112f1873ed\klist.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.26100.1_none_b99a252d184bf301\ssh-agent.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.26100.1591_none_125fbf4d94a6971e\audiodg.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.26100.1591_none_479c61fda9b5207c\msinfo32.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tasklist_31bf3856ad364e35_10.0.26100.1_none_2536da91c2de3f14\tasklist.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-whoami_31bf3856ad364e35_10.0.26100.1_none_cb7026b6ea62c346\whoami.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winlogon-tools_31bf3856ad364e35_10.0.26100.1_none_91672235f58871de\mpnotify.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-setx_31bf3856ad364e35_10.0.26100.1_none_b3bf2881b5fdbf6e\setx.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-castserver_31bf3856ad364e35_10.0.26100.1_none_c492cc5e99915bfb\CastSrv.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_10.0.26100.1591_none_2c59a493cf48778f\msinfo32.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-win32calc_31bf3856ad364e35_10.0.26100.1_none_50f771e4b4a3c0ee\win32calc.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\x86_aspnet_regsql_b03f5f7f11d50a3a_10.0.26100.1_none_f419bf716fbd61e7\aspnet_regsql.exe- 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-07_02213cb8497ecf09eeeb83f04f1c104b_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6488
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 10.7MB
- SHA256 5953f896969687620890d3e91f6b408dd2f2ad3a21ba73effc294da01e223a83
- MD5 ddc90eed10331f341732122006493873
- SHA1 cbcf4de870166b0164ab88c0a15558c615473ca2
- SHA512 f2dbac4a3581dc3c08ca901e4ea0a7bd46e8769c35ed91cb72e910de89588a11a6563ee3f9a8306d9f17c2606685d3fafc4c1ea6979e6d5b549494d1ddf0363e
- SSDEEP 98304:khpBinjOykGcIy6fnUm8UdjoG0oAaldmdmnpT6dnUm8UTIezSC6v2XMHL:8pAnjOyny6f18UZorKmd0V6d18UTfI
- TLSH T103B68D12F26442B6D072C075CA969765EA313C550BB0D6DF2281B7E93E33BD1BB3A721
- MD5 SHA1 SHA512 SSDEEP TLSH