Analysis
- max time kernel
148s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/10/2026, 08:24
Behavioral task
behavioral1
Sample
2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe
- Size 13.2MB
- Sample261002-ka134ssshx
- SHA256 6b238e8bf6c5d4c366abbf783819e8b10b847a47bc343aba165706ca82a68abf
- MD5 96a0a3efb315f049e73fa536d10ce444
- SHA1 b2984db8b6ac9be61708b72acb14812d15f97a62
- SHA512 216eb73714355fea7b0f2286c064a27ebae240689a8a238c7b1f8d37d7c10d3ac1d9e6ab15ab5d9c09991223bb20b4d5e45cc218f4054a3268ba53d48635e476
- SSDEEP 49152:lpPZuyWSG+BBvGvnjOyYVwOZTGRIsJ63+bEbb7exVFchS9mKzPji0Aj8:lhpBinjOykYIsJ63+bEbbS9mKrjoY
- TLSH T1B2D6BF12B7909332E0F341B6C5BA8351E7757C65073083CB63C8B66D2D77AD1993A7A2
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UPX dump on OEP (original entry point) 2 IoCs
resource yara_rule behavioral2/files/0x000400000001b85a-4.dat UPX behavioral2/files/0x000f000000006aaa-1116.dat UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\cmmon32.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\SysWOW64\TCPSVCS.EXE 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\SysWOW64\bthudtask.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\SysWOW64\ctfmon.exe 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\SysWOW64\doskey.exe 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\SysWOW64\pcaui.exe 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\SysWOW64\dialer.exe 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\SysWOW64\ndadmin.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\SysWOW64\PATHPING.EXE 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\SysWOW64\upnpcont.exe 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\SysWOW64\lodctr.exe 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\SysWOW64\mtstocom.exe 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\SysWOW64\user.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\SysWOW64\fsquirt.exe 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\SysWOW64\hh.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\SysWOW64\icsunattend.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\SysWOW64\more.com- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\SysWOW64\TapiUnattend.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\SysWOW64\comp.exe 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\SysWOW64\regsvr32.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\SysWOW64\prevhost.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\SysWOW64\Dism.exe 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\SysWOW64\netbtugc.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\SysWOW64\mode.com- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\SysWOW64\newdev.exe 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\SysWOW64\cmdkey.exe 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\SysWOW64\cscript.exe 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\SysWOW64\PkgMgr.exe 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\SysWOW64\label.exe 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\SysWOW64\LaunchTM.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\SysWOW64\mstsc.exe 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\SysWOW64\netiougc.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\SysWOW64\odbcconf.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\SysWOW64\shrpubw.exe 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\SysWOW64\Dism.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\SysWOW64\provlaunch.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\SysWOW64\sfc.exe 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\SysWOW64\wscript.exe 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\SysWOW64\cmd.exe 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\SysWOW64\isoburn.exe 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\SysWOW64\PickerHost.exe 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\SysWOW64\calc.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\SysWOW64\esentutl.exe 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\SysWOW64\ipconfig.exe 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\SysWOW64\label.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\SysWOW64\netiougc.exe 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\SysWOW64\rrinstaller.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\SysWOW64\ByteCodeGenerator.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\SysWOW64\Com\comrepl.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\SysWOW64\TpmInit.exe 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe -
resource yara_rule behavioral2/memory/5080-0-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/files/0x000400000001b85a-4.dat upx behavioral2/memory/5080-273-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/5080-272-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/5080-544-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/5080-844-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/files/0x000f000000006aaa-1116.dat upx behavioral2/memory/5080-1137-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/5080-1418-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/5080-1589-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/5080-1977-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/5080-2329-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/5080-2666-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/5080-2925-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/5080-2926-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/5080-2927-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/5080-2928-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/5080-2929-0x0000000000400000-0x000000000040F000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Program Files (x86)\Windows Mail\wab.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\show_third_party_software_licenses.bat 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ioningsecureprocess_31bf3856ad364e35_10.0.26100.1150_none_32bd5b6fcfab5b78\r\psp.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.26100.1591_none_37c9b95250fac754\r\perfmon.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-cttunesvr_31bf3856ad364e35_10.0.26100.1_none_f74329f6bb45918a\cttunesvr.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\WinSxS\amd64_microsoft-hns-diagnosticstool_31bf3856ad364e35_10.0.26100.1591_none_41d04808d6b6d160\hnsdiag.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-netcfg_31bf3856ad364e35_10.0.26100.1150_none_ac162c2f01636f98\netcfg.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-klist_31bf3856ad364e35_10.0.26100.1_none_3e2848112f1873ed\klist.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.26100.1591_none_b67e058f470e99bc\r\SystemSettings.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..nsimulation-service_31bf3856ad364e35_10.0.26100.1150_none_74a667b087b1ac17\r\PerceptionSimulationService.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-scripting_31bf3856ad364e35_10.0.26100.1591_none_e4284e3cb060c8bf\r\cscript.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-f..temcompareutilities_31bf3856ad364e35_10.0.26100.1_none_080ef735d249ae9a\fc.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-more_31bf3856ad364e35_10.0.26100.1_none_b3a2a31db5fc0bbd\more.com- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\OOBENetworkCaptivePortal.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deviceenroller_31bf3856ad364e35_10.0.26100.1591_none_5d054cd1bd51eff3\DeviceEnroller.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-directshow-dvdplay_31bf3856ad364e35_10.0.26100.1150_none_9d9573a1c9f40852\r\dvdplay.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filehistory-ui_31bf3856ad364e35_10.0.26100.1591_none_e9f27dc23b0bf8db\r\FileHistory.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\WinSxS\amd64_winappsdk-cbs_31bf3856ad364e35_10.0.26100.1591_none_60aad032a4073cbd\r\DeploymentAgent.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.26100.1591_none_161bc21b2130ea78\WerFault.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\WinSxS\x86_microsoft-windows-s..or-native-serverbox_31bf3856ad364e35_10.0.26100.1_none_1093cc6b1440f8d9\RMActivate_ssp.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..dialoghost.appxmain_31bf3856ad364e35_10.0.26100.1150_none_ab86ca35f5ea21f3\CredDialogHost.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-networkux-legacyux_31bf3856ad364e35_10.0.26100.1591_none_b94392693d48770c\LegacyNetUXHost.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-usercpl-usermgrbroker_31bf3856ad364e35_10.0.26100.1150_none_b29361d684a1914e\UserAccountBroker.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-r..-commandline-editor_31bf3856ad364e35_10.0.26100.1_none_38dc86afc79cd565\reg.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.26100.1150_none_1763b5dd5aadd1af\r\dpnsvr.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.26100.1301_none_22d8cfb46252dd83\HvsiSettingsWorker.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\WinSxS\msil_smsvchost_b03f5f7f11d50a3a_10.0.26100.1_none_b6996f0c07fabc7a\SMSvcHost.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediafoundation_31bf3856ad364e35_10.0.26100.1591_none_4273d4b4f12943c2\mfpmp.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-nslookup_31bf3856ad364e35_10.0.26100.1_none_d2c8c6a3035feb05\nslookup.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\explorer.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmwp_31bf3856ad364e35_10.0.26100.1742_none_d0e5d15b0fe45285\r\vmwp.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-setup-support_31bf3856ad364e35_11.0.26100.1591_none_a548c43e37f4b89b\ie4uinit.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..cquisition-wiawow64_31bf3856ad364e35_10.0.26100.1150_none_686748f1a08de9d9\r\wiawow64.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.26100.1591_none_db09ff29aaa57394\wowreg32.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..atibility-assistant_31bf3856ad364e35_10.0.26100.1591_none_cf86813ad32dd96e\r\pcalua.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.26100.1455_none_a73031e9ff1c7610\r\wmpconfig.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\r\CBS\DesktopStickerEditorWin32Exe\DesktopStickerEditorWin32Exe.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tapisetup_31bf3856ad364e35_10.0.26100.1_none_713b7d7638176261\TapiUnattend.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\WinSxS\x86_netfx-vb_compiler_b03f5f7f11d50a3a_10.0.27000.360_none_22e4d76dba1efc07\vbc.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-iechooser_31bf3856ad364e35_11.0.26100.1150_none_d0187a73d39a8bd8\r\IEChooser.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-lsatrustlet_31bf3856ad364e35_10.0.26100.1591_none_805965242ec082f4\LsaIso.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.26100.1742_none_227796ba348ec62b\r\MoUsoCoreWorker.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\WinSxS\amd64_netfx4-aspnet_state_exe_b03f5f7f11d50a3a_4.0.15912.0_none_61e02e661eddd7ec\aspnet_state.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.26100.1_none_bf65878ace780f5e\shrpubw.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1000_none_5f95cc5803dfafcd\r\mofcomp.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\WinSxS\x86_regsvcs_b03f5f7f11d50a3a_10.0.26100.1_none_8e6ef7811b80d32a\RegSvcs.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess32.exe 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-surrogate_31bf3856ad364e35_10.0.26100.1150_none_e00b3f2ca36be9f9\dllhst3g.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-htmlhelp_31bf3856ad364e35_10.0.26100.1591_none_6415f1d934c35258\r\hh.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-ielowutil_31bf3856ad364e35_11.0.26100.1150_none_e61570904a993a97\r\ielowutil.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nslookup_31bf3856ad364e35_10.0.26100.1150_none_6767c467165c7708\r\nslookup.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rpc-ping_31bf3856ad364e35_10.0.26100.1_none_9aadb670a9451e5d\RpcPing.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1738_none_a5031b637767a4e7\poqexec.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-safedocs-main_31bf3856ad364e35_10.0.26100.1591_none_c0c9b77316cf6b10\sdclt.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-speech-userexperience_31bf3856ad364e35_10.0.26100.1591_none_b7c9eb31fbd37700\r\SpeechUXWiz.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\WinSxS\msil_servicemodelreg_b03f5f7f11d50a3a_10.0.26100.1_none_ef0c64fcaf8f69dc\ServiceModelReg.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..cation-creduibroker_31bf3856ad364e35_10.0.26100.1591_none_70cfc556f1a01eb7\CredentialUIBroker.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..nfiguration-cmdline_31bf3856ad364e35_10.0.26100.1_none_10a40aea1dac80e8\powercfg.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-upnpdevicehost_31bf3856ad364e35_10.0.26100.1591_none_67fcd9ee18eb970e\r\upnpcont.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..e-licensing-service_31bf3856ad364e35_10.0.26100.1591_none_20144fc41cfe40b9\ClipDLS.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..cation-creduibroker_31bf3856ad364e35_10.0.26100.1591_none_667b1b04bd3f5cbc\CredentialUIBroker.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..tx-dxgiadaptercache_31bf3856ad364e35_10.0.26100.1591_none_435b2733e13c4689\dxgiadaptercache.exe- 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_96a0a3efb315f049e73fa536d10ce444_amadey_coinminer_elex_glassworm_redline-stealer_rhadaman.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5080
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:2328
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 14.1MB
- SHA256 d137c9c49a96761caa3fc91ca6eef5492ac560f72ff26a1035381ace543037d4
- MD5 364f05d38846dfb25c2b5a5979a97cd4
- SHA1 4c898405f21ac3607cf48082b6a6241745175e99
- SHA512 3cea15934f6561c6e98ecdaabd1d1ca75b13ffcffd1528c30ded6810e12a316bd88d380d917631a64870c9e3ac991ac08b08728536f5bdd89333f3944e07a4db
- SSDEEP 98304:lhpBinjOykYIsJ63+bEbbS9mKrjo5ezSC6v2XMH9:TpAnjOyb+umKfoeC
- TLSH T164E69E12F6A48332D0F380B6C5E69795FA723C55073086CB5389B76C2E77AD1893A772
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\InitializeApprove.exe-
- Size 13.7MB
- SHA256 21e0143ee6116b3048de9216a14d9c5fac1e020eb2e8288597acb4721330e776
- MD5 63bd6e68e5b7bc51db8b323c95822fc7
- SHA1 780cd5aecfb9f8c96730fee67b8fd1bfbd8196d2
- SHA512 3747354ff6298d88f6b546aba56589abce6335bc09e4fbc5581fa17fd8c88526be99fa42853b8d747ee1793d97fc33e40d31a20e769a8e9d352671d2ae265faa
- SSDEEP 98304:lhpBinjOykYIsJ63+bEbbS9mKrjo6Imly:TpAnjOyb+umKfo6Im4
- TLSH T182E6C012B7909332E0F341B6C5BA8351E7757C65073083CB63C8B66D2E77AD1993A7A2
- MD5 SHA1 SHA512 SSDEEP TLSH