Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/07/2026, 19:00
Behavioral task
behavioral1
Sample
2026-07-04_4936ac9cb5930cee51bbad3dd16c8b87_amadey_darkgate_glassworm_icedid.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
32 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-04_4936ac9cb5930cee51bbad3dd16c8b87_amadey_darkgate_glassworm_icedid.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
35 signatures
150 seconds
General
- Target 2026-07-04_4936ac9cb5930cee51bbad3dd16c8b87_amadey_darkgate_glassworm_icedid.exe
- Size 10.0MB
- Sample260704-xn1qqact21
- SHA256 11e75f08759a05bda735ee5a82c65df1cb404aa04151bdd230132cfd8e9c1238
- MD5 4936ac9cb5930cee51bbad3dd16c8b87
- SHA1 b74d2f4a5e4e1f8bedbb1dd3bbefd29e7e6864f7
- SHA512 3ebdefa7d9e34fc19ae8afc0c10475d5157d5380471e0f63743cec774a03ed11ff800ce1587d942a0ac8ed4ef0e89071ad2e40fc424d5d2d2d3330aafbaef250
- SSDEEP 6144:OmnCS9wz4ZoeETEW1gbpJA3KpSL0pDpGKb:Omnt9ULePJA3KY0pk
- TLSH T16CB64A43BBD000BAD5BE463944735A19A73AF8114B62EBDF169404ED0E27BC6DD38F62
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Sheetrat Payload 2 IoCs
Sheetrat aka NonEuclid RAT is a trojan written in C#.
resource yara_rule behavioral1/memory/4240-0-0x000002A427210000-0x000002A427272000-memory.dmp family_sheetrat_v1 behavioral1/memory/5052-289-0x00000197A3D80000-0x00000197A3DE2000-memory.dmp family_sheetrat_v1 - Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Program Files\\svchost.exe," 2026-07-04_4936ac9cb5930cee51bbad3dd16c8b87_amadey_darkgate_glassworm_icedid.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" 2026-07-04_4936ac9cb5930cee51bbad3dd16c8b87_amadey_darkgate_glassworm_icedid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" Registry.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" 2026-07-04_4936ac9cb5930cee51bbad3dd16c8b87_amadey_darkgate_glassworm_icedid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" Registry.exe - UAC bypass 3 TTPs 12 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-07-04_4936ac9cb5930cee51bbad3dd16c8b87_amadey_darkgate_glassworm_icedid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 2026-07-04_4936ac9cb5930cee51bbad3dd16c8b87_amadey_darkgate_glassworm_icedid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" 2026-07-04_4936ac9cb5930cee51bbad3dd16c8b87_amadey_darkgate_glassworm_icedid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 2026-07-04_4936ac9cb5930cee51bbad3dd16c8b87_amadey_darkgate_glassworm_icedid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe - Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 2 IoCs
resource yara_rule behavioral1/memory/4240-0-0x000002A427210000-0x000002A427272000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL behavioral1/memory/5052-289-0x00000197A3D80000-0x00000197A3DE2000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL - Detects executables (downlaoders) containing URLs to raw contents of a paste 2 IoCs
resource yara_rule behavioral1/memory/4240-0-0x000002A427210000-0x000002A427272000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawPaste_URL behavioral1/memory/5052-289-0x00000197A3D80000-0x00000197A3DE2000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawPaste_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 2 IoCs
resource yara_rule behavioral1/memory/4240-0-0x000002A427210000-0x000002A427272000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender behavioral1/memory/5052-289-0x00000197A3D80000-0x00000197A3DE2000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Process not Found - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation 2026-07-04_4936ac9cb5930cee51bbad3dd16c8b87_amadey_darkgate_glassworm_icedid.exe - Executes dropped EXE 35 IoCs
pid Process 784 Process not Found 4560 Process not Found 1372 Process not Found 1164 Process not Found 3296 Process not Found 1916 Process not Found 2120 Process not Found 1756 Process not Found 2828 Process not Found 608 Process not Found 664 Process not Found 5048 Process not Found 1648 Process not Found 2676 Process not Found 4384 Process not Found 2668 Process not Found 3060 Process not Found 4392 Process not Found 1872 Process not Found 3640 Process not Found 2636 Process not Found 2436 Process not Found 3020 Process not Found 312 Process not Found 4388 Process not Found 2612 Process not Found 696 Process not Found 2984 Process not Found 1992 Process not Found 3956 Process not Found 2184 Process not Found 3820 svchost.exe 1188 Process not Found 5052 Registry.exe 1384 Process not Found - Loads dropped DLL 64 IoCs
pid Process 3176 Process not Found 4316 Process not Found 4604 Process not Found 3708 Process not Found 4784 Process not Found 3600 Process not Found 1136 Process not Found 3268 Process not Found 60 Process not Found 844 Process not Found 2376 CMD.exe 916 CMD.exe 220 cmd.exe 3176 Process not Found 784 Process not Found 1372 Process not Found 4316 Process not Found 1164 Process not Found 4560 Process not Found 1136 Process not Found 3708 Process not Found 4604 Process not Found 1756 Process not Found 608 Process not Found 1064 Process not Found 664 Process not Found 4784 Process not Found 2120 Process not Found 3296 Process not Found 1916 Process not Found 3600 Process not Found 2828 Process not Found 5048 Process not Found 5052 Registry.exe 1648 Process not Found 2676 Process not Found 4384 Process not Found 3640 Process not Found 1872 Process not Found 4392 Process not Found 2668 Process not Found 3060 Process not Found 2636 Process not Found 2436 Process not Found 312 Process not Found 1188 Process not Found 2984 Process not Found 1992 Process not Found 3956 Process not Found 696 Process not Found 2612 Process not Found 4388 Process not Found 3020 Process not Found 60 Process not Found 2376 CMD.exe 2184 Process not Found 1476 CMD.exe 3176 Process not Found 4316 Process not Found 784 Process not Found 1372 Process not Found 4560 Process not Found 1164 Process not Found 4604 Process not Found - Windows security modification 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" 2026-07-04_4936ac9cb5930cee51bbad3dd16c8b87_amadey_darkgate_glassworm_icedid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" Registry.exe - Checks whether UAC is enabled 1 TTPs 6 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 2026-07-04_4936ac9cb5930cee51bbad3dd16c8b87_amadey_darkgate_glassworm_icedid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-07-04_4936ac9cb5930cee51bbad3dd16c8b87_amadey_darkgate_glassworm_icedid.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Registry.exe - Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 14 ip-api.com - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan Process not Found File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work Process not Found File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B76BE66D46C355931939D8CF818D03FD_30070D1E013A39CA7A94F919F7922FDF Process not Found File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml Process not Found File opened for modification C:\Windows\System32\Tasks\RuntimeBroker.exe Process not Found File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work Process not Found File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 Process not Found File opened for modification C:\Windows\System32\Tasks\WindowsControlW Process not Found File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work Process not Found File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 Process not Found File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419 Process not Found File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F Process not Found File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_30070D1E013A39CA7A94F919F7922FDF Process not Found File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749 Process not Found File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 Process not Found - Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\svchost.exe 2026-07-04_4936ac9cb5930cee51bbad3dd16c8b87_amadey_darkgate_glassworm_icedid.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Registry.exe 2026-07-04_4936ac9cb5930cee51bbad3dd16c8b87_amadey_darkgate_glassworm_icedid.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 18 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Mfg Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000\LogConf Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Mfg Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Service Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000\LogConf Process not Found - Checks processor information in registry 2 TTPs 12 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier Process not Found Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 Process not Found Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Process not Found Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Process not Found Key security queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Process not Found Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 Process not Found - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Process not Found - Modifies data under HKEY_USERS 21 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Property Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{0CB4A94A-6E8C-477B-88C8-A3799FC97414} Process not Found Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{0CB4A94A-6E8C-477B-88C8-A3799FC97414}\DeviceTicket = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb0100000052bff57e6a76c04988198fb8d249ecc7000000000200000000001066000000010000200000004308407fcce44d05bd4de4ce029e25e511db8d7577ce7255a37a2874f6371199000000000e8000000002000020000000decf189084d9b6c4f88ba2646f84bbf9431f7c2cc03a820bceec2ee9d26ec812000c0000c71c32ced9775dcb1d2190b21f9b641fa62ffc7326c1b815e2283342c4ab0a148a8b04646ae43e19b3592e9787d3202b951a5c0f1424e8fa47ab9128917b88396227d40b670196c24b3bcf2337d67173978d68a5b578792019325a8b9855480becdabd544e3e9aad4fb137718efd0e8d3c9e273aaa7dfa97768712aac2945b2479cdc6498feddb5080866b0c60a13b47884bf463c2f12156e7569dffa2ff39d6b067d48f168c1b73800d561fc94247992f3124b3383306bc10f5555d4f349d116c5d734ddc580b0b7b8359a1c893bf7ccf14d45c7877af8a2d711ecb941c59cb0080c069cfe56d7338beaed7ce939a35a1e776bc9c1c845f52e15694ceec3cbce2ac6fc2f5845d5354eed2285ec735d9bd872a957e935bd36c130eacb0ddf13484197ad6fbc1416a96375d702da8e271ae803637c0ebf82505c3435a9d3af814abb21d58e4eeccd380925c15fec71e690ba935849d4460f7a99a97c62272fd561d218651c3255934d7de4ba4f4d75a3a3df58b31a9487546f4421b1b12cbffd9d3080d39d8e59ebdaf8f52612f3a7e484fd79638a0ec36222753c086ff857637badc316037004c4c78b8e1b46ba81b37917d0868f61022938169b6d87481a7b816489ce512bb5685aba075330cb703b2521c958efe6e70b33552a45d663cb9cc0ed071402db8ad9f49d963bf17a9d7b2f744ac6c3aaf4880a0bba7602429d18dbc276c0ec02ee6bd745149984ab53a6e4b96207bb25bf2bca5a9319b7b4bedfc2737dc6a4667db8cdd60e5d67138507540978d1a87c7e663ec91dc25fa3de1939086aa8ced409e561857422c76e6ec4611a589437ae67d1d8c8fe15f5abc89a7915bc7fd18835e9191de22bafcaf86b065987489d28b926efa95708d216f8f3a96064e52b94a58688f2935b58c881dcd7d23e6cd285a39d18ac5bd1e0ea94f099a14a1d1f9e64ec1be3329b38b2fedf0d6cf59a40f4b5fccefee4969e1749c08d79368d1006ec68ef0a33c127c00902ab4b113e0727c365ea2841cb8015b08eae2f6a5ee66732159c30c4f7826e1760cee8c026e99475ec3bb2fb9a1ca1d65ef4954e7c62338155669aa5902a65c49b19ea18c74928682df7b0258c1b03b9abef2a3a239edd90c716fa8d470055fa01a66d31a30fbef628d849498151e362b3501e5574586689b30f839f47c5ebb4084de1b043118ca7c3dd9789faea67005fb5391d901056bdb6627cab356c8ce62085a5b7da1ecd64249d0d993a72fb273edf074b1703145befdb2b39b44694989748f90ad14e77e5b77f5821aa775b7df77533f8b7128953c6cf9c2841400062a6c2db6d17eac22319695da1209a338bb722182a7a9306e08b1b0601520c1e1965cba7d445e9bbc6b1a7957d4b8f1dfda5876b20030e00fbbbfc2ec7dea614366b5e82ce2058a85ec05fa00fb8d351b519f99a581d59932adeef1f8c9f6f161ca29c78fe27435310895a8011b9407bad283a46468b71d86cee0644919ba175d2c67df419151448c8e7f26a531cddfce75e8cde94827604c9bc03c99b56fd5bdd1cc6866d94876997d185eb67c2acd785f7115abb27ea5c4b53712e0246d7706f6719bedbe40e84496d32528effc34f0dd89b21802626ab3f7820cd9f2c56f927570cf15bcf98e2675437d6cd9ace0d92a5265f22532ecbdf269d53eadd27d3044a7ea6147a1e4af7418cbda10d3216824438b5b8044ced9ff014cd972d9232c36a13ab3d8d6d5e64147174d3b48b9f1c238d3aeb3490a9eb2240de61225e2e4b1a7473c50a0893e3e3e8d28bfa4ca6c4b9306f2f0e80c50b79b2e0e7c82dcad4e54ea3bbee7332b10f592668f55bf0dcb1b392ac4c917d31aee6dbfccc11b71b277eef034421cb8c671f2a07171137d7c7aa1cc010c5838fdabdbf804ae169e05fc002df91f9c38e47a2133c0b12a5cb89b71554156424df0fc5cfa410b2ead93c9c9cd87ee0fa6779ef6d986bd72f7f838e816c254a746eb3b2ee921f30aa299e0729dd95254b03d7944e4977ac646d6a51648267415a52cc84e304f4cfaba182413603a41bf5caa91b40218aee2de30d3f2d074a799e0ac980ac57036c2a1186572499ecc8ec9d94489e348d727da25a350e60df79995562cfe36eec88f68a485a1ad0fdd21cc5826529d55653237f8c95c8537640345904e6796ca8ca295ecd183734630db49c7d4c06013b5e5177c1852a624973a914371a0a0b0c14492e93959e69b301ad0a904b149a8c27d08939813f95a9b9f6eaa9a9d769776803a7cfe62a39433fc48d2e926d156c8647f2b4d02bbb71215136a579e2e284d675298b19c995e3f2ae03b35f87a934a0854d64698563e72cdfcb8786f5ca055b0811e0d3bb7f27b2ddf1ffc5200cd3cf9c25632f837795fd508cb7553f2a9d03d6ff1d1aeed0480dff92afd6b13681b53ae92789a5db9e89250f75bccc3c3634a604f043e5e2ad723463ba4cffb4dfc5a6053d1044353590d92b649f5cc1e9e9c8d7d83c08b6ce8a488a7442b086dea5fb0b281280dd06c723fe1b699cceb719d49f4fdd48f3498dd4b2fe2801687b0f284d42ef7ec858c5b304a3309f76ec13fde582012c89b36547e37dba743b969b7e460e515c5f870fb6c0442ab7710698e2c21df07a987784f4fa560518e59d1fb5b2659699575c53c2ef5fc7158376614d55cdbed6a74728ea8dc4e57949001cf3c76357af8af178984ed7ace0647e17da4d7f38e0bdc6d4b9a08a2961a38bb00589c96d14038a1439ef630307825d40bf536eef5d8119ca982a0e90f6a1e4f57ce4414568c56857be3a43c68ed81623e141ba6b3bfb906932f81cae2ec11b9c302bb99e984da092ac4ba7b0a8db64ea0c552cf41eb040e100de69046a529c29ed47831aca6c89fe10a1f9c7012e1c73a23e025838a22077ade28d6811c742c357edb40d50bca28071b8e00b94e1db0b20a1df39626c9d58b000a39a23fe2d9261fe136c6e327d8dce5da477955ff2de0a1496d0f25a58603c53c6a1ac5cf38529d491c4aec3b32d5ac0e48a0a648653ff66698cccc06062261c57dc07ead43e06e34406a68e05190bec5e2d357265a22fb7f14796f7c32702e55b0c8f15b296d04a022af4a87ea70da245b5a9bac13794a3ffe96dd62b780baa790613054c9d14bf8b384aaa7d0ef632e02589f56391d6d755952e697cd2fa8f39f67b43878bd7e292793995930894f7621f19e8d325a26443afd41a5425b6805bcdb54ac0aa44d07810a22f4b56040803d1fad4e373067a1f0bd6c2ae3c6b04995063b6f3aa9264835f02f5a5517af3ed29ff0a428fc464540b3c95e0ba63346ea0e811b4a2261375f4f99a8dd79870e92943b834ab1b87e108f9866aa303e28cf7760d70919429d067b862678e04e504579d924e429e9654710591fdfcd4cc0a49b118bda8880286cc4a4e5fcb6f6aa0a607688d888b84701aacf47851e96016de26d5de47d751de82dcd267f0e6e86735f97959ce7a4f9df913b51a34c23a30162dab2a83ae29db603a4b16b7c9ea8926a0ac0fafb7f49a3188a04492a57a8ba0537d38a9907a00c873e3b5b725d4edec94dc2bdade051a5b11fb9a1d1dff568f4365d021fa1c559cb47aa8cc0efc5ed825237a12a448254ca61557c25cc9c2e71c48438f47424af2d2ad0d0777d8cd74c74db4bed3cfb59777ce8347f18d31dce9bbc0274a9e5419feb64b221518ea1474085fc5057115bc8cda2e839570c6c7feaf108720b214f4dd6e5b7cb17191e88cba3f3d88db019c70e0cf5bd9d904b5dedaf973b91921c7d5eba9351665e74cdba34def341480bd91b563c4936d139b8a068329fbb07955372fa318c830fff91066728b821e95d4b1b984b1d602e45fdeafe5e30edd4cfe94ee607bf77f92dd3a30fdf9e60579e3f724e2d1cf6736926e3e6fb4cd6dc853951535aa317d24817725fba69e46c1d3ce846ba3cdbcf25a63a3fd70917bfee8a74ad52a46752087bcd058ffe73f952881af87fca94811bb10f54e17aa46bd4109a1d0e7c840bcd1c77335ae65112747d034bf610e363362c487e3926efdb67d99f4771132bb44f6987b6f0c18cc45a7640f41e9fb4a51e488343c32fc2752452bf32c2da69320b3ef9718f3fa52ff6b970f1f425fa23470d08918498ca897b6e41c839f198e884d529d530e90df9b2acab25566137d131d6676fae97c69ce2c96cd7deb9e19c023ffcabfba02e2c1e04af3a3638f7947834facd42d50d72aad8a8a3b00601fa90e7d0eed1218b6a17275221eca8423a4f2a8e6b32f84612570cf35ddcb665b0336c1ce3578f75da0a9d905512e5a32e397b0df6cde36defef4000000051d9bcfa16d4d67078e550e2919c9a4793111586684b717cca7349bb5d2136a2976b3225737d1d888467a54cff49b6ef06daae3908bdc596c1889d5a61850a8f Process not Found Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process not Found Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1783191739" Process not Found Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata Process not Found Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "577889346,5804129,17110992,7202269,9179409,24262478,41484365,17110988,7153487,508368333,17962391,17962392,3462423,3702920,3700754,3965062,24262474,4297094,7153421,3462365,18716193,7153435,7202265,507286179,41816131,20502174,6308191,18407617,39125643,539756558,504928405,504928410,24262477,25036127,24262473,9179410,6104718,9179411,51475283,41185282,39389248,539756557,528570079" Process not Found Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\ExtendedProperties\LID = "001800185A9F43BB" Process not Found Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{0CB4A94A-6E8C-477B-88C8-A3799FC97414}\ApplicationFlags = "1" Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry Process not Found Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 50,1329 10,944 15,943 6,1329 15,1329 100,1329 6,943 10,943 15,944 6,940 50,941 15,941 10,941 6,942 15,942 10,942 6,944 100,944 10,944 50,940 6,940 100,940 10,940 15" Process not Found Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Property\001800185A9F43BB = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb0100000052bff57e6a76c04988198fb8d249ecc700000000020000000000106600000001000020000000b99089fc85073c128699b3eb1c2598c5b81ed83ea096a33dd14b96f4d6f9caf3000000000e80000000020000200000006974c74b38b92acd245240b62dfc2cdbcbd3cfd9566b11d1ad127525dc6229d280000000ea23cc28acc0a3e8c5b954fa171fccdca6190bbed03e17bdef7241e235d7917e78889c7422e54bce9429d950078bb93f19b8552487da295e10f17b0501de3721cd364cd85d19f0aaa9cd4d042b9b62f7a9e472b15fd0291f2227f634636229b591f853aaf3bfcc6e3a8ac362f1585e0e213e29f7d84baa53502f8ed7ce1b6b29400000004dda19bd4cfed1d33c7912ff85b6472cb4b925a288e65c419aabf8b673dac7ff9a0c17c155d76f880eb94f412c5a3f94df5b874331283c62b89f70244564983e Process not Found Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{0CB4A94A-6E8C-477B-88C8-A3799FC97414}\DeviceId = "001800185A9F43BB" Process not Found Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Fri, 03 Jul 2026 00:55:59 GMT" Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe Process not Found Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor Process not Found Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={6B56C152-4BCD-4F9A-B5A2-C9E557149C8B}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&" Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0 Process not Found - Modifies registry class 11 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy Process not Found Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "134276652767195106" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PTT = "134276652770007968" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "134276652786101243" Process not Found Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI Process not Found Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1 Process not Found Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "134276652757819966" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PTT = "134276652761257317" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PTT = "134276652787663772" Process not Found - Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4332 schtasks.exe 5024 schtasks.exe - Suspicious behavior: EnumeratesProcesses 48 IoCs
pid Process 4240 2026-07-04_4936ac9cb5930cee51bbad3dd16c8b87_amadey_darkgate_glassworm_icedid.exe 4240 2026-07-04_4936ac9cb5930cee51bbad3dd16c8b87_amadey_darkgate_glassworm_icedid.exe 4240 2026-07-04_4936ac9cb5930cee51bbad3dd16c8b87_amadey_darkgate_glassworm_icedid.exe 2112 Process not Found 2112 Process not Found 2112 Process not Found 2112 Process not Found 2112 Process not Found 2112 Process not Found 2112 Process not Found 2112 Process not Found 2112 Process not Found 2112 Process not Found 2112 Process not Found 2112 Process not Found 2112 Process not Found 3820 svchost.exe 3820 svchost.exe 3820 svchost.exe 3820 svchost.exe 5052 Registry.exe 5052 Registry.exe 5052 Registry.exe 5052 Registry.exe 3820 svchost.exe 3820 svchost.exe 3820 svchost.exe 3820 svchost.exe 3820 svchost.exe 3820 svchost.exe 3820 svchost.exe 3820 svchost.exe 3820 svchost.exe 3820 svchost.exe 3820 svchost.exe 3820 svchost.exe 3820 svchost.exe 3820 svchost.exe 3820 svchost.exe 3820 svchost.exe 3820 svchost.exe 3820 svchost.exe 3820 svchost.exe 3820 svchost.exe 3820 svchost.exe 3820 svchost.exe 3820 svchost.exe 3820 svchost.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3176 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4240 2026-07-04_4936ac9cb5930cee51bbad3dd16c8b87_amadey_darkgate_glassworm_icedid.exe Token: SeShutdownPrivilege 3176 Process not Found Token: SeCreatePagefilePrivilege 3176 Process not Found Token: SeShutdownPrivilege 3176 Process not Found Token: SeCreatePagefilePrivilege 3176 Process not Found Token: SeShutdownPrivilege 3176 Process not Found Token: SeCreatePagefilePrivilege 3176 Process not Found Token: SeShutdownPrivilege 3176 Process not Found Token: SeCreatePagefilePrivilege 3176 Process not Found Token: SeShutdownPrivilege 3176 Process not Found Token: SeCreatePagefilePrivilege 3176 Process not Found Token: SeShutdownPrivilege 3176 Process not Found Token: SeCreatePagefilePrivilege 3176 Process not Found Token: SeDebugPrivilege 3820 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2668 Process not Found Token: SeIncreaseQuotaPrivilege 2668 Process not Found Token: SeSecurityPrivilege 2668 Process not Found Token: SeTakeOwnershipPrivilege 2668 Process not Found Token: SeLoadDriverPrivilege 2668 Process not Found Token: SeSystemtimePrivilege 2668 Process not Found Token: SeBackupPrivilege 2668 Process not Found Token: SeRestorePrivilege 2668 Process not Found Token: SeShutdownPrivilege 2668 Process not Found Token: SeSystemEnvironmentPrivilege 2668 Process not Found Token: SeUndockPrivilege 2668 Process not Found Token: SeManageVolumePrivilege 2668 Process not Found Token: SeAssignPrimaryTokenPrivilege 2668 Process not Found Token: SeIncreaseQuotaPrivilege 2668 Process not Found Token: SeSecurityPrivilege 2668 Process not Found Token: SeTakeOwnershipPrivilege 2668 Process not Found Token: SeLoadDriverPrivilege 2668 Process not Found Token: SeSystemtimePrivilege 2668 Process not Found Token: SeBackupPrivilege 2668 Process not Found Token: SeRestorePrivilege 2668 Process not Found Token: SeShutdownPrivilege 2668 Process not Found Token: SeSystemEnvironmentPrivilege 2668 Process not Found Token: SeUndockPrivilege 2668 Process not Found Token: SeManageVolumePrivilege 2668 Process not Found Token: SeDebugPrivilege 2112 Process not Found Token: SeAuditPrivilege 2312 Process not Found Token: SeAuditPrivilege 2612 Process not Found Token: SeAuditPrivilege 2612 Process not Found Token: SeAssignPrimaryTokenPrivilege 2668 Process not Found Token: SeIncreaseQuotaPrivilege 2668 Process not Found Token: SeSecurityPrivilege 2668 Process not Found Token: SeTakeOwnershipPrivilege 2668 Process not Found Token: SeLoadDriverPrivilege 2668 Process not Found Token: SeSystemtimePrivilege 2668 Process not Found Token: SeBackupPrivilege 2668 Process not Found Token: SeRestorePrivilege 2668 Process not Found Token: SeShutdownPrivilege 2668 Process not Found Token: SeSystemEnvironmentPrivilege 2668 Process not Found Token: SeUndockPrivilege 2668 Process not Found Token: SeManageVolumePrivilege 2668 Process not Found Token: SeAssignPrimaryTokenPrivilege 2668 Process not Found Token: SeIncreaseQuotaPrivilege 2668 Process not Found Token: SeSecurityPrivilege 2668 Process not Found Token: SeTakeOwnershipPrivilege 2668 Process not Found Token: SeLoadDriverPrivilege 2668 Process not Found Token: SeSystemtimePrivilege 2668 Process not Found Token: SeBackupPrivilege 2668 Process not Found Token: SeRestorePrivilege 2668 Process not Found Token: SeShutdownPrivilege 2668 Process not Found Token: SeSystemEnvironmentPrivilege 2668 Process not Found - Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 4240 wrote to memory of 2376 4240 2026-07-04_4936ac9cb5930cee51bbad3dd16c8b87_amadey_darkgate_glassworm_icedid.exe 96 PID 4240 wrote to memory of 916 4240 2026-07-04_4936ac9cb5930cee51bbad3dd16c8b87_amadey_darkgate_glassworm_icedid.exe 97 PID 4240 wrote to memory of 220 4240 2026-07-04_4936ac9cb5930cee51bbad3dd16c8b87_amadey_darkgate_glassworm_icedid.exe 98 PID 4240 wrote to memory of 2720 4240 2026-07-04_4936ac9cb5930cee51bbad3dd16c8b87_amadey_darkgate_glassworm_icedid.exe 102 PID 220 wrote to memory of 5024 220 cmd.exe 104 PID 220 wrote to memory of 5024 220 cmd.exe 104 PID 916 wrote to memory of 4880 916 CMD.exe 105 PID 916 wrote to memory of 4880 916 CMD.exe 105 PID 2720 wrote to memory of 4332 2720 cmd.exe 106 PID 4240 wrote to memory of 3820 4240 2026-07-04_4936ac9cb5930cee51bbad3dd16c8b87_amadey_darkgate_glassworm_icedid.exe 107 PID 3176 wrote to memory of 1832 3176 Process not Found PID 3176 wrote to memory of 1832 3176 Process not Found PID 3176 wrote to memory of 3100 3176 Process not Found PID 3176 wrote to memory of 3100 3176 Process not Found PID 784 wrote to memory of 3684 784 Process not Found 111 PID 3820 wrote to memory of 1476 3820 svchost.exe 112 PID 1476 wrote to memory of 3236 1476 CMD.exe 114 PID 1476 wrote to memory of 3236 1476 CMD.exe 114 PID 784 wrote to memory of 3048 784 Process not Found 115 PID 784 wrote to memory of 4448 784 Process not Found 117 PID 784 wrote to memory of 4112 784 Process not Found 118 PID 784 wrote to memory of 4112 784 Process not Found 118 PID 3176 wrote to memory of 2460 3176 Process not Found PID 3176 wrote to memory of 2460 3176 Process not Found - System policy modification 1 TTPs 18 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" 2026-07-04_4936ac9cb5930cee51bbad3dd16c8b87_amadey_darkgate_glassworm_icedid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "1" 2026-07-04_4936ac9cb5930cee51bbad3dd16c8b87_amadey_darkgate_glassworm_icedid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-07-04_4936ac9cb5930cee51bbad3dd16c8b87_amadey_darkgate_glassworm_icedid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 2026-07-04_4936ac9cb5930cee51bbad3dd16c8b87_amadey_darkgate_glassworm_icedid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "1" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" Registry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" 2026-07-04_4936ac9cb5930cee51bbad3dd16c8b87_amadey_darkgate_glassworm_icedid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 2026-07-04_4936ac9cb5930cee51bbad3dd16c8b87_amadey_darkgate_glassworm_icedid.exe - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-04_4936ac9cb5930cee51bbad3dd16c8b87_amadey_darkgate_glassworm_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-04_4936ac9cb5930cee51bbad3dd16c8b87_amadey_darkgate_glassworm_icedid.exe"1⤵
- Modifies WinLogon for persistence
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender TamperProtection settings
- UAC bypass
- Checks computer location settings
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4240 -
C:\Windows\SYSTEM32\CMD.exe"CMD" netsh advfirewall firewall add rule name="WindowsControl" dir=in action=allow program="C:\Program Files\svchost.exe" enable=yes & exit2⤵
- Loads dropped DLL
PID:2376
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c schtasks /delete /F /TN "RuntimeBroker.exe" & exit2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Windows\system32\schtasks.exeschtasks /delete /F /TN "RuntimeBroker.exe"3⤵PID:4880
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc onlogon /tn "RuntimeBroker.exe" /tr "C:\Program Files\svchost.exe" & exit2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /tn "RuntimeBroker.exe" /tr "C:\Program Files\svchost.exe"3⤵
- Scheduled Task/Job: Scheduled Task
PID:5024
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 30 /tn "WindowsControlW" /tr "C:\Windows\Registry.exe" /RL HIGHEST & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 30 /tn "WindowsControlW" /tr "C:\Windows\Registry.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:4332
-
-
-
C:\Program Files\svchost.exe"C:\Program Files\svchost.exe"2⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender TamperProtection settings
- UAC bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3820 -
C:\Windows\SYSTEM32\CMD.exe"CMD" /c schtasks /delete /F /TN "RuntimeBroker.exe" & exit3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Windows\system32\schtasks.exeschtasks /delete /F /TN "RuntimeBroker.exe"4⤵PID:3236
-
-
-
-
C:\Windows\Registry.exeC:\Windows\Registry.exe1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender TamperProtection settings
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- System policy modification
PID:5052
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:3684
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:3048
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:4448
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
PID:4112
-
C:\Windows\system32\UsoClient.exeC:\Windows\system32\usoclient.exe1⤵PID:4880
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify Tools
4Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\Microsoft\Windows\OneSettings\config.json
- Size 6KB
- SHA256 a798dead9cfb0ce27e67b6298c9cc85df87d4af6f0c865742a76a4cf5c208068
- MD5 5e1a01d6bf4e00ffeaf4e5531d0bec8e
- SHA1 48eea89c355a37371c53a598a7ca892c2194edf8
- SHA512 1dd0fdc05ea760ec9bd5c495bd32be3487dd52fc905322e272a009105782c2c1780714b51e54d62302d16a6893062120db0cbccbd5a4f7b271551f141b49af8c
- SSDEEP 192:nGDCctouMgRXUhWwpoTQ/eKIO2CE4cA1RdrPLjT:nG5touMgRXUhWwpoTQ/eKL2tXWRVPLjT
- TLSH T115E1750DB184C87E9FAB61E6644AB940C6687B27ADC44CE4E5C28D1ED45F74C711CBE8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\$77temp\3e6192e6-22c1-4e35-8a27-ce3b225ab0a5.dll
- Size 147KB
- SHA256 ff95571a4b3880be2807cad8875ee6ccd0b2b705caf0d4d0d0f56950dd78ee5a
- MD5 6295c384c45ef898b40608f7af8155db
- SHA1 75111839c370518271e1b625f506062f7ab31c3a
- SHA512 eea64a94234dff73912699c59e1356579509e2bcffe22b066f65843d230875a7d9fb5f6c75a7a0c81395cdd14e0f6e72bff3a7f39ca455f3d7026edd54b4c801
- SSDEEP 3072:n3+8MsFRgZM1a+UwrL0vxmQ4ktFN6y3Fb1:n3KpSL0pD
- TLSH T11FE30807B6E500FBD8B6813585536A19B7BAF4540322EBEB825449FD0F2BBD1ED39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work
- Size 2KB
- SHA256 98c054088df4957e8d6361fd2539c219bcf35f8a524aad8f5d1a95f218e990e9
- MD5 ceb7caa4e9c4b8d760dbf7e9e5ca44c5
- SHA1 a3879621f9493414d497ea6d70fbf17e283d5c08
- SHA512 1eddfbf4cb62d3c5b4755a371316304aaeabb00f01bad03fb4f925a98a2f0824f613537d86deddd648a74d694dc13ed5183e761fdc1ec92589f6fa28beb7fbff
- TLSH T12951455367EE1108F2F76B2CAEB620218EA77D455D39C46D00AC240DCBF7E6289607B7
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work
- Size 2KB
- SHA256 727c9e7b91e144e453d5b32e18f12508ee84dabe71bc852941d9c9b4923f9e02
- MD5 7d612892b20e70250dbd00d0cdd4f09b
- SHA1 63251cfa4e5d6cbf6fb14f6d8a7407dbe763d3f5
- SHA512 f8d481f3300947d49ce5ab988a9d4e3154746afccc97081cbed1135ffb24fc107203d485dda2d5d714e74e752c614d8cfd16781ea93450fe782ffae3f77066d1
- TLSH T15151455367EE1108F2F76B2CAEB620218EA77D455D39C46D00AC240DCBF7E6289607B7
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work
- Size 2KB
- SHA256 55f203d6b40a39a6beba9dd3a2cb9034284f49578009835dd4f0f8e1db6ebe2f
- MD5 1e8e2076314d54dd72e7ee09ff8a52ab
- SHA1 5fd0a67671430f66237f483eef39ff599b892272
- SHA512 5b0c97284923c4619d9c00cba20ce1c6d65d1826abe664c390b04283f7a663256b4a6efe51f794cb5ec82ccea80307729addde841469da8d041cbcfd94feb0f6
- TLSH T1CD51355367EE1108F2F76B2CAEB620218EA77D455D39C46D01AC240DCBF7E6289607B7
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work
- Size 2KB
- SHA256 a1106ed0845cd438e074344e0fe296dc10ee121a0179e09398eaaea2357c614a
- MD5 0b990e24f1e839462c0ac35fef1d119e
- SHA1 9e17905f8f68f9ce0a2024d57b537aa8b39c6708
- SHA512 c65ba42fc0a2cb0b70888beb8ca334f7d5a8eaf954a5ef7adaecbcb4ce8d61b34858dfd9560954f95f59b4d8110a79ceaa39088b6a0caf8b42ceda41b46ec4a4
- TLSH T18C51355367EE1108F2F76B2CAEB620218EA77D455D39C46D01AC240DCBF7E6289607B7
- MD5 SHA1 SHA512 TLSH