Analysis
- max time kernel
149s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
04/08/2026, 06:32
General
- Target 2026-08-04_8414edaa0a5042e3b54909fab4673b6c_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
- Size 419KB
- Sample260804-hat9fsed89
- SHA256 f96b37a086bf032b832288aad7f820be00063a087e0423eb55a9986559d6c61e
Malware Config
Signatures
- Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Detects Sheetrat Payload 1 IoCs
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
- UAC bypass 3 TTPs 4 IoCs
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 1 IoCs
- Detects executables (downlaoders) containing URLs to raw contents of a paste 1 IoCs
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
- Modifies Windows Firewall 2 TTPs 1 IoCs
- Executes dropped EXE 1 IoCs
- Stops running service(s) 4 TTPs
- Checks whether UAC is enabled 1 TTPs 2 IoCs
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 18 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 37 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
- System policy modification 1 TTPs 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_8414edaa0a5042e3b54909fab4673b6c_amadey_cobalt-strike_darkgate_glassworm_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_8414edaa0a5042e3b54909fab4673b6c_amadey_cobalt-strike_darkgate_glassworm_icedid.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\2026-08-04_8414edaa0a5042e3b54909fab4673b6c_amadey_cobalt-strike_darkgate_glassworm_icedid.exe" enable=yes & exit2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\2026-08-04_8414edaa0a5042e3b54909fab4673b6c_amadey_cobalt-strike_darkgate_glassworm_icedid.exe" enable=yes3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete "WindowsUpdaterDefenderMicrosoft"2⤵
- Launches sc.exe
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1System Services
1Service Execution
1Persistence
Create or Modify System Process
3Windows Service
3Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
3Windows Service
3Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
2Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
0addb66c309844f89feab7f27ad1540d.dll
memory/1860-7-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp
memory/1860-10-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp
memory/1860-3-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp
memory/1860-4-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp
memory/1860-5-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp
memory/1860-6-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp
memory/1860-8-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp
memory/1860-1-0x0000024A5EB50000-0x0000024A5EBBE000-memory.dmp
memory/1860-2-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp
memory/1860-11-0x00007FFE89B40000-0x00007FFE89DA3000-memory.dmp
memory/1860-9-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp
memory/1860-12-0x00007FFE88600000-0x00007FFE886C7000-memory.dmp
memory/1860-13-0x00007FFE86F50000-0x00007FFE872F1000-memory.dmp
memory/1860-14-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp
memory/1860-0-0x00007FFE66FBF000-0x00007FFE66FC0000-memory.dmp
memory/1860-19-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp
memory/2632-18-0x00007FFE49C80000-0x00007FFE49C90000-memory.dmp