Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/10/2026, 22:46
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
- Size 11.9MB
- Sample261009-2py1qsds3m
- SHA256 1533fae3dbdc29da5781efc37d7938a26f331a597987a62fd271630d2389be44
- MD5 0c371a29aee25d624db1aec8fac49aa9
- SHA1 114dfa887ba149eeab64a577da5cc0d66366c208
- SHA512 4f45a0642760ac0b3ec410bea893ccff1323ee841c8144a861ee3d4f34231a3d671074c7d4e01be7e76327ebcf93cd8403bad04ad687e4cc259dc9ecd434be0a
- SSDEEP 196608:8pAnjOyb+h+WdA18UA6/Kmd04dqcIITfl:OAnT+h+DDCqr/d
- TLSH T12DC68D13B2D005B6D0AA9139CF65863597B17C2A4BF1D2EF3144B6D92E73BC07A3A712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral2/files/0x000700000001b864-3.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral2/files/0x000700000001b864-3.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule behavioral2/files/0x000700000001b864-3.dat UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\whoami.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\AppVDllSurrogate.exe 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\waitfor.exe 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\regedit.exe 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\icsunattend.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\msfeedssync.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\netsh.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\help.exe 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\label.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Netplwiz.exe 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\clip.exe 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\systray.exe 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\w32tm.exe 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\sc.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\control.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\help.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\iscsicpl.exe 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Msdtc\Trace\msdtcvtr.bat- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\proquota.exe 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\TpmInit.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\wusa.exe 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ctfmon.exe 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\logman.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\mstsc.exe 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\netiougc.exe 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\reg.exe 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\RmClient.exe 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ARP.EXE- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\efsui.exe 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\ReAgentc.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\SearchIndexer.exe 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\sfc.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\sudo.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\Com\comrepl.exe 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\dpnsvr.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\driverquery.exe 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\edpnotify.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\userinit.exe 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\cttunesvr.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\relog.exe 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\systeminfo.exe 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\tcmsetup.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\tttracer.exe 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\bthudtask.exe 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SysWOW64\diskusage.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Media Player\setup_wm.exe 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\show_third_party_software_licenses.bat- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Defender\MpDlpCmd.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Mail\wab.exe 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\show_third_party_software_licenses.bat- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Media Player\wmpnetwk.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Windows Media Player\wmpshare.exe 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\RestartAgent.exe 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..onment-core-tcbboot_31bf3856ad364e35_10.0.26100.1742_none_9c21c77df9054577\tcblaunch.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bootux.deployment_31bf3856ad364e35_10.0.26100.1150_none_d9f89d43802b0109\bootim.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tabletpc-controlpanel_31bf3856ad364e35_10.0.26100.1_none_dc671a88c37dde08\MultiDigiMon.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-consumers_31bf3856ad364e35_10.0.26100.1_none_47c5cfc8c16dfb4a\scrcons.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.26100.1_none_fcf0e4a9852b11e5\ssh-keyscan.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_windows-defender-nis-service_31bf3856ad364e35_10.0.26100.1_none_1ae648617b7c1208\NisSrv.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..sition-uicomponents_31bf3856ad364e35_10.0.26100.1_none_d63cd2082238f294\wiaacmgr.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Microsoft.AAD.BrokerPlugin.exe 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.26100.1150_none_3a3e93ee89e96c57\r\LicensingUI.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-starttiledata_31bf3856ad364e35_10.0.26100.1591_none_2c8539fa8a63de14\r\DataStoreCacheDumpTool.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-b..nfrastructurebghost_31bf3856ad364e35_10.0.26100.1_none_783b330506082901\backgroundTaskHost.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Speech\Common\sapisvr.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-iediag_31bf3856ad364e35_11.0.26100.1591_none_f6583c166accd553\r\iediagcmd.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..cesframework-ctfmon_31bf3856ad364e35_10.0.26100.1591_none_38f087fa4098616b\r\ctfmon.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.26100.1150_none_8097a9dca8ee24c4\change.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devicecensus_31bf3856ad364e35_10.0.26100.1591_none_4b326ab0aa8da2bf\r\DeviceCensus.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..devicescontrolpanel_31bf3856ad364e35_10.0.26100.1150_none_c0871c4af90b9611\r\ImagingDevices.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-htmlapplication_31bf3856ad364e35_11.0.26100.1_none_8a3f1279dcc4073c\mshta.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-logagent_31bf3856ad364e35_10.0.26100.1150_none_8727dcae71f2c0a2\logagent.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..agement-commandline_31bf3856ad364e35_10.0.26100.1_none_36c64bb72fffb46a\Dism.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msdt_31bf3856ad364e35_10.0.26100.712_none_51f923c23ace47fd\msdt.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-autochk_31bf3856ad364e35_10.0.26100.1_none_dee795aa2a4dbd74\autochk.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-servicing_31bf3856ad364e35_10.0.26100.1150_none_c1fbd1a9557e5b13\r\bfsvc.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..rvices-adam-install_31bf3856ad364e35_10.0.26100.1150_none_b8bbaaa483060b58\r\adaminstall.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..nt-enrollmenthelper_31bf3856ad364e35_10.0.26100.1591_none_d68a8e522d36701f\PinEnrollmentBroker.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-scrnsave_31bf3856ad364e35_10.0.26100.1150_none_7d26f17a8a4ec06a\scrnsave.scr- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mystify_31bf3856ad364e35_10.0.26100.1150_none_8bf8eb890f472d80\r\Mystify.scr- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sensors-runtimebroker_31bf3856ad364e35_10.0.26100.1591_none_4483428c4f7fb3a1\r\SensorRuntimeBroker.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..x-directxdiagnostic_31bf3856ad364e35_10.0.26100.1591_none_c9d83dab422b920f\dxdiag.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ie-ielowutil_31bf3856ad364e35_11.0.26100.1_none_db3c93db8c43c151\ielowutil.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wrp-integrity-client_31bf3856ad364e35_10.0.26100.1591_none_c6fec8639b4d0909\r\sfc.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..raries-servercommon_31bf3856ad364e35_10.0.26100.1_none_b0d3de420cfbf405\appcmd.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rundll32_31bf3856ad364e35_10.0.26100.1591_none_7e19f7088f522c23\rundll32.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\x86_netfx4-aspnet_wp_exe_b03f5f7f11d50a3a_4.0.15912.0_none_58273f1b819405f8\aspnet_wp.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\SystemApps\NcsiUwpApp_8wekyb3d8bbwe\NcsiUwpApp.exe 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.26100.1301_none_22d8cfb46252dd83\r\WDAGNetDiag.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-smartscreen_31bf3856ad364e35_10.0.26100.1150_none_59491cddd00c2dba\r\smartscreen.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-recover_31bf3856ad364e35_10.0.26100.1_none_8d5ba08151885bf2\recover.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\x86_netfx-dw_b03f5f7f11d50a3a_10.0.26100.1_none_71dc1710cec228ac\dw20.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-repadmin_31bf3856ad364e35_10.0.26100.1150_none_9cab7767030559d4\repadmin.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-feedsbs_31bf3856ad364e35_11.0.26100.1150_none_dbed5373b4208431\r\msfeedssync.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..nfiguration-cmdline_31bf3856ad364e35_10.0.26100.1_none_064f6097e94bbeed\powercfg.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-directshow-dvdplay_31bf3856ad364e35_10.0.26100.1_none_08f675ddb6f77c4f\dvdplay.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_netfx4-ilasm_exe_b03f5f7f11d50a3a_4.0.15912.0_none_61c655cc264adc4b\ilasm.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-securitycenter-core_31bf3856ad364e35_10.0.26100.1591_none_c055032b96806f80\wscadminui.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ed-chinese-moimeexe_31bf3856ad364e35_10.0.26100.1150_none_80f34faace9aed01\ChsIME.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-photoscreensaver_31bf3856ad364e35_10.0.26100.1150_none_07b5cf4f085fe80c\PhotoScreensaver.scr- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.26100.1150_none_fb078fe8106f7572\r\cmmon32.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-slidetoshutdown_31bf3856ad364e35_10.0.26100.1_none_911934c40449e6a1\SlideToShutDown.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_userexperience-lkg_31bf3856ad364e35_10.0.26100.1742_none_3c72368675eae921\LKG.Search\FESearchHost.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_jsc_b03f5f7f11d50a3a_4.0.15912.0_none_2e8b40428114406d\jsc.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..llshield-wow64-main_31bf3856ad364e35_10.0.26100.1_none_6b60acbaf3301f6c\setup.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..packagedcwalauncher_31bf3856ad364e35_10.0.26100.1150_none_7f2121a6ad7592a8\PackagedCWALauncher.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-edge-microsoftedgesh_31bf3856ad364e35_10.0.26100.1150_none_648c8216bc35a3e5\MicrosoftEdgeSH.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-healthattestation-csp_31bf3856ad364e35_10.0.26100.1591_none_c6d9ee3b6b5cb11f\r\HealthAttestationClientAgent.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.26100.1455_none_a73031e9ff1c7610\r\wmpconfig.exe- 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-07_0c371a29aee25d624db1aec8fac49aa9_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6072
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 12.8MB
- SHA256 785647041f8af6ea110889b9a29457ebd77d699eba09a81e9e44fc54efb0999c
- MD5 daab70346dac28dc105286e1d1b4e7ab
- SHA1 91454e0ea97709a6a9477f5d366a65b28829cf6d
- SHA512 85bd13f63e590acdbbeb1ef4a7ae94d07afe6d256cce71345ca956421b260a5e056204e10f72d382031e3365059b9e247294ee4d0b8d884ce0dbfd699c422711
- SSDEEP 196608:8pAnjOyb+h+WdA18UA6/Kmd04dqcIITfxT:OAnT+h+DDCqr/p
- TLSH T12BD68D13B2E44176D0AA9139CE658635E7B17C2A4BF1C2DF3144B6D92E737C07A3A722
- MD5 SHA1 SHA512 SSDEEP TLSH