Analysis
- max time kernel
150s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/09/2026, 02:05
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe
- Size 10.6MB
- Sample260910-ch85pacn5v
- SHA256 2794d3e89dd77c1b694ebb52828d56d31d006997624d9df583ee169e668d9c92
- MD5 e511d3c2dd20607b3b3a0d8653a14b6e
- SHA1 58588764f34aea9e5a4ce8b040d04475923abcd1
- SHA512 f55501c0936e428bce58f3b1e75c094c60654512938b2bfdd8c8d5576ebe9a4204ce895b87a092bfe5f3e94fc4282b069d7cd0241413f9c3428a82552fc68452
- SSDEEP 196608:8pdyn8OyJgV9z8bd8Kmd07ojKmd0Ao+hPU:OdyndV6q1+qmx
- TLSH T1B6B68E13F2A446B5D0A2C075CE969225EB313C5907F196EB3284B7E93E37AD07B39721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule behavioral2/files/0x000d00000001c54f-4.dat UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\instnm.exe 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\netbtugc.exe 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\WWAHost.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\ddodiag.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\finger.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\net.exe 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\regedt32.exe 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\SecEdit.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\Taskmgr.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\dccw.exe 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\diskusage.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\Fondue.exe 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\iscsicli.exe 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\dfrgui.exe 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\DWWIN.EXE- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\find.exe 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\NETSTAT.EXE 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\PickerHost.exe 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\DWWIN.EXE 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\ieUnatt.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\mcbuilder.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\notepad.exe 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\winrshost.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\chkntfs.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\mode.com- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\OposHost.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\rasdial.exe 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\rasphone.exe 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\recover.exe 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\cttunesvr.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\driverquery.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\gpscript.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\timeout.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\verclsid.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\efsui.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\more.com- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\nslookup.exe 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\upnpcont.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\Windows.WARP.JITService.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\certreq.exe 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\cliconfg.exe 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\control.exe 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\dcomcnfg.exe 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\dpapimig.exe 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\icacls.exe 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\iscsicli.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\MuiUnattend.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\net.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\OposHost.exe 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\Robocopy.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\ROUTE.EXE- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\rrinstaller.exe 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\winrshost.exe 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\fsutil.exe 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SysWOW64\mountvol.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Windows Defender\MpCopyAccelerator.exe 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Windows Defender\MsMpEng.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Windows Media Player\wmlaunch.exe 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Windows Defender\MpDlpCmd.exe 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseImdsCollector.exe 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\uninstall.cmd 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Windows Media Player\setup_wm.exe 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Windows Media Player\wmlaunch.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Windows Media Player\wmplayer.exe 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\7-Zip\Uninstall.exe 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Windows Defender\MsMpEng.exe 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Windows Defender\MpDefenderCoreService.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\LimitGrant.cmd 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\SystemApps\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\SecureAssessmentBrowser.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-defrag-cmdline_31bf3856ad364e35_10.0.26100.1150_none_63632032763f629f\r\Defrag.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..pectedcodepathtasks_31bf3856ad364e35_10.0.26100.1591_none_99fc5c721ed12b35\UCConfigTask.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_curl_31bf3856ad364e35_10.0.26100.1301_none_1a384873cd299392\curl.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.26100.1591_none_986ba09695018480\r\UevTemplateConfigItemGenerator.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..-network-management_31bf3856ad364e35_10.0.26100.1591_none_6022424238410d39\nmbind.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemrestore-main_31bf3856ad364e35_10.0.26100.1591_none_e29fcb0e6345d56d\r\rstrui.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-usercpl-usermgrbroker_31bf3856ad364e35_10.0.26100.1150_none_b29361d684a1914e\UserAccountBroker.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winrsplugins_31bf3856ad364e35_10.0.26100.1150_none_b21dc6dde1913832\r\winrshost.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\msil_dfsvc_b03f5f7f11d50a3a_10.0.26100.1_none_0a0ceefe3c8778a8\dfsvc.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unp_31bf3856ad364e35_10.0.26100.1591_none_48bae61d0882b74d\UpdateNotificationMgr.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.26100.1591_none_4aa2580f59a05075\r\wuaucltcore.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_serviceinitiatedhealing-client_31bf3856ad364e35_10.0.26100.1591_none_b89e4fe4764210cb\SIHClient.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_windows-defender-management-v1_31bf3856ad364e35_10.0.26100.1150_none_b68ce2ecb8338725\ConfigSecurityPolicy.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..d-searchintegration_31bf3856ad364e35_10.0.26100.1591_none_2bcc571573c94745\r\IMESEARCH.EXE- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1000_none_5f95cc5803dfafcd\r\mofcomp.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rpc-ping_31bf3856ad364e35_10.0.26100.1_none_9aadb670a9451e5d\RpcPing.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rundll32_31bf3856ad364e35_10.0.26100.1591_none_73c54cb65af16a28\rundll32.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\hh.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wslconfig_31bf3856ad364e35_10.0.26100.1150_none_3d0419d754916346\wslconfig.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\WsatConfig.exe 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.26100.1591_none_70d0fee4fcc0ae07\r\sdbinst.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-scripting_31bf3856ad364e35_10.0.26100.1591_none_e4284e3cb060c8bf\r\wscript.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tokenbroker_31bf3856ad364e35_10.0.26100.1591_none_3f72725b5aa2e9e7\TokenBrokerCookies.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-spelling-host.binaries_31bf3856ad364e35_10.0.26100.1150_none_a91ae2d49210b003\r\MsSpellCheckingHost.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winrsplugins_31bf3856ad364e35_10.0.26100.1150_none_b21dc6dde1913832\winrshost.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\msil_multipoint-wmsdashboard_31bf3856ad364e35_10.0.26100.1_none_4d201f2d5466838a\WmsDashboard.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SystemApps\Microsoft.Windows.PrintQueueActionCenter_cw5n1h2txyewy\PrintQueueActionCenter.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..-client-aggregators_31bf3856ad364e35_10.0.26100.1591_none_1057fc96a520e997\r\AggregatorHost.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-r..sistance-dcomserver_31bf3856ad364e35_10.0.26100.1_none_373bf2a6128009cf\raserver.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..e-flexible-platform_31bf3856ad364e35_10.0.26100.1591_none_dd61c19e2e413ac5\fclip.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-displayswitch_31bf3856ad364e35_10.0.26100.1150_none_88a9016fd4655cfd\DisplaySwitch.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.26100.1150_none_3a3e93ee89e96c57\LicensingUI.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tasklist_31bf3856ad364e35_10.0.26100.1_none_2536da91c2de3f14\tasklist.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-control_31bf3856ad364e35_10.0.26100.1_none_a0b44bf0476b30ed\control.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\NarratorQuickStart.exe 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-powershell-exe_31bf3856ad364e35_10.0.26100.1_none_6609a7146abf3e09\powershell.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.26100.1591_none_720b9e48718f9c5a\spoolsv.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-runas_31bf3856ad364e35_10.0.26100.1_none_5cdbf1a4c5f9fd2c\runas.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ative-serverbox-isv_31bf3856ad364e35_10.0.26100.1150_none_90fe1fffae58c8c8\r\RMActivate_ssp_isv.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-usercpl-usermgrbroker_31bf3856ad364e35_10.0.26100.1150_none_b29361d684a1914e\r\UserAccountBroker.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_regasm_b03f5f7f11d50a3a_10.0.26100.1_none_73a69603b491b174\RegAsm.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_8465405a0441f0fb\print.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.26100.1591_none_986ba09695018480\r\UevAppMonitor.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tabletpc-controlpanel_31bf3856ad364e35_10.0.26100.1_none_dc671a88c37dde08\tabcal.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.26100.1591_none_421e63a4855b894f\resmon.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.26100.1_none_66689223fd72e96f\cmstp.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sort_31bf3856ad364e35_10.0.26100.1_none_b3067605b67046e6\sort.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_10.0.26100.1591_none_f3f0f30e057f293d\mstsc.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-win32calc_31bf3856ad364e35_10.0.26100.1_none_50f771e4b4a3c0ee\win32calc.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\SystemApps\ParentalControls_cw5n1h2txyewy\WpcUapApp.exe 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-commandline-dsacls_31bf3856ad364e35_10.0.26100.1_none_460eda816899b508\dsacls.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_10.0.26100.1150_none_1da178eaf53e7c4d\PrintBrmEngine.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..raries-servercommon_31bf3856ad364e35_10.0.26100.1_none_b0d3de420cfbf405\iissetup.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ageengine-utilities_31bf3856ad364e35_10.0.26100.1591_none_754be8247547f871\r\esentutl.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-es-authentication_31bf3856ad364e35_10.0.26100.1150_none_dda40d17c682c33c\EhStorAuthn.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-consumers_31bf3856ad364e35_10.0.26100.1_none_47c5cfc8c16dfb4a\scrcons.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-grouppolicy-script_31bf3856ad364e35_10.0.26100.1_none_6c5f8b350c999f6d\gpscript.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rundll32_31bf3856ad364e35_10.0.26100.1591_none_7e19f7088f522c23\r\rundll32.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Windows\WinSxS\x86_microsoft-windows-s..or-native-serverbox_31bf3856ad364e35_10.0.26100.1_none_1093cc6b1440f8d9\RMActivate_ssp.exe- 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-08_e511d3c2dd20607b3b3a0d8653a14b6e_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:884
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 11.6MB
- SHA256 18fe3e446163c511afca91bf9b0628dc3a19d5aad4331980d7888cfc74bfb2e2
- MD5 5af35d076078591c2a8320a8b441c0dc
- SHA1 6e4026cdaf1ae290b3fffd1091614c11dcbc693a
- SHA512 f1c2ddf83cc351d835a9403f5bc5e5e8ca7dfe3218700d2801cb6e46eb24f64ac95b1c9bd9055e8915296642a345adebfc05972e8c320ade27a092efa273c937
- SSDEEP 196608:8pdyn8OyJgV9z8bd8Kmd07ojKmd0Ao+hPKa:OdyndV6q1+qmc
- TLSH T180C68E13F2644276D0A3C075CE969665EB313C4907F196EB2284B7E83E37AD17B3A721
- MD5 SHA1 SHA512 SSDEEP TLSH