Analysis
- max time kernel
149s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/10/2026, 03:09
Behavioral task
behavioral1
Sample
2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
- Size 10.4MB
- Sample261006-dnvd6acf36
- SHA256 8df0d593927dac6c7884508802560dae621e1fdde070d1f76cabee2bf63cd8ea
- MD5 e624f2729c36fe796a87d63bc3455665
- SHA1 67c0e5dd62bb29dde770bbf104c8847acf93d223
- SHA512 4e6e4df2e8f62e70e035f16c3768707d39c5a7af34d2f6fc443f9562d1aceec4dacde309a49051f6dad276a2280925d2bd245ca76e838f6760e8b13817cc2c91
- SSDEEP 98304:IRPRRdmTIOSAk+d8MUSXIYa3Y4zhq9ceq9+2xl/SSay:IFRnmTfgEU8IBtzhWqQI0py
- TLSH T1C9B68D13B2E801D9E06ED27CC5714636E7B1BC269B3197CF26507A691EB3BD04E3A712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Fesber payload 12 IoCs
resource yara_rule behavioral2/files/0x000c00000001c62d-3.dat family_fesber behavioral2/memory/1392-442-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/1392-815-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/1392-1189-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/1392-1265-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/1392-1266-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/1392-1267-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/1392-1268-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/1392-1270-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/1392-1272-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/1392-1273-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/1392-1274-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber - Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe fsb.exe" 2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral2/files/0x000c00000001c62d-3.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral2/files/0x000c00000001c62d-3.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\fsb.stb 2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\fsb.tmp 2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File opened for modification C:\Windows\SysWOW64\fsb.tmp 2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe -
resource yara_rule behavioral2/files/0x000c00000001c62d-3.dat upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Mozilla Firefox\pingsender.exe 2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe- 2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe- 2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Internet Explorer\iexplore.exe- 2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe- 2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe- 2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe- 2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe- 2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe 2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe- 2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe- 2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe- 2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE- 2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe 2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe- 2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe- 2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe- 2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe- 2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe- 2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe- 2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\7-Zip\Uninstall.exe- 2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe- 2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe- 2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe 2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe- 2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe- 2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe- 2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe 2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe- 2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_106906\javaw.exe 2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe 2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe- 2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Mozilla Firefox\firefox.exe- 2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe- 2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe 2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe- 2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe- 2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE 2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe- 2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\dotnet\dotnet.exe 2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe- 2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe- 2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe- 2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe- 2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE- 2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe- 2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe 2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe- 2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - Suspicious behavior: LoadsDriver 1 IoCs
pid 4
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-05_e624f2729c36fe796a87d63bc3455665_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:1392
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 11.0MB
- SHA256 fd915f990d96831acf2ed9a5d2bba29a400873f25cda474474d7a7b1efb79c77
- MD5 f7c0f9557b24537c8d78cf3db82259af
- SHA1 585ce44ca17ca1ff62b3e099ef1fd9947fcded3b
- SHA512 8f844382484c1107ae19051a68d606e531c05dd3b9f658f971f4187f16e0968fa698f02362d1f37d892dc0f1011ea832fcd89d929cc928d95638093c23eb1d0a
- SSDEEP 98304:9RPRRdmTIOSAk+d8MUSXIYa3Y4zhq9ceq9+2xl/SSaynjo:9FRnmTfgEU8IBtzhWqQI0pyjo
- TLSH T1E7C68D13F2E801E9E06AD27CC5714636EBB1BC265B3197CF265076691E73BD04E3A722
- MD5 SHA1 SHA512 SSDEEP TLSH