Overview

overview

10

Static

static

10

2026-08-05...id.exe

windows10-2004-x64

10

2026-08-05...id.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    05/08/2026, 03:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-05_711eb910a1f0170c4c64aacd343929f2_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
  • Size 445KB
  • Sample260805-djfeface46
  • SHA256 62ecf97310224ebabdae83b722c5047073269c1d87294860a2c0da43f1a80259
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryevasionexecutionsheetratpersistenceprivilege_escalationtrojan

Malware Config

Signatures

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat
  • Detects Sheetrat Payload 2 IoCs

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs
    evasiontrojan
  • UAC bypass 3 TTPs 4 IoCs
    defense_evasiontrojan
  • Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 2 IoCs
  • Detects executables (downlaoders) containing URLs to raw contents of a paste 2 IoCs
  • Detects executables embedding registry key / value combination indicative of disabling Windows Defen 2 IoCs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    defense_evasion
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Windows security modification 2 TTPs 1 IoCs
    defense_evasiontrojan
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    defense_evasiontrojan
  • Looks up external IP address via web service 1 TTPs 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Modifies data under HKEY_USERS 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs
  • System policy modification 1 TTPs 6 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-05_711eb910a1f0170c4c64aacd343929f2_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-05_711eb910a1f0170c4c64aacd343929f2_amadey_cobalt-strike_darkgate_glassworm_icedid.exe"
    1⤵
    • Modifies Windows Defender DisableAntiSpyware settings
    • Modifies Windows Defender TamperProtection settings
    • UAC bypass
    • Windows security modification
    • Checks whether UAC is enabled
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1152
    • C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\2026-08-05_711eb910a1f0170c4c64aacd343929f2_amadey_cobalt-strike_darkgate_glassworm_icedid.exe" enable=yes & exit
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:400
      • C:\Windows\system32\netsh.exe
        netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\2026-08-05_711eb910a1f0170c4c64aacd343929f2_amadey_cobalt-strike_darkgate_glassworm_icedid.exe" enable=yes
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        PID:4384
    • C:\Windows\SYSTEM32\sc.exe
      "sc.exe" delete "WindowsUpdaterDefenderMicrosoft"
      2⤵
      • Launches sc.exe
      PID:5016
    • C:\Windows\SYSTEM32\sc.exe
      "sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-08-05_711eb910a1f0170c4c64aacd343929f2_amadey_cobalt-strike_darkgate_glassworm_icedid.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"
      2⤵
      • Launches sc.exe
      PID:3488
    • C:\Windows\SYSTEM32\sc.exe
      "sc.exe" start "WindowsUpdaterDefenderMicrosoft"
      2⤵
      • Launches sc.exe
      PID:4840
    • C:\Windows\SYSTEM32\schtasks.exe
      "schtasks.exe" /Delete /TN "User_Feed_Synchronization-58aeb3a4-d391-4ca4-9247-22ea23536936" /F
      2⤵
        PID:3344
      • C:\Windows\SYSTEM32\schtasks.exe
        "schtasks.exe" /Create /TN "User_Feed_Synchronization-58aeb3a4-d391-4ca4-9247-22ea23536936" /XML "C:\Users\Admin\AppData\Local\Temp\b685af65-c03e-4f06-99ca-0949aab535da.xml" /F
        2⤵
        • Scheduled Task/Job: Scheduled Task
        PID:2232
      • C:\Windows\SYSTEM32\schtasks.exe
        "schtasks.exe" /Delete /TN "SystemSoundsService_d7e1e472" /F
        2⤵
          PID:1972
        • C:\Windows\SYSTEM32\schtasks.exe
          "schtasks.exe" /Create /TN "SystemSoundsService_d7e1e472" /XML "C:\Users\Admin\AppData\Local\Temp\e016e066-572e-4eb6-a0ec-d8693dcd1ee7.xml" /F
          2⤵
          • Scheduled Task/Job: Scheduled Task
          PID:1332
        • C:\Windows\SYSTEM32\schtasks.exe
          "schtasks.exe" /Delete /TN "UsbCeip_3ad33ee7" /F
          2⤵
            PID:4576
          • C:\Windows\SYSTEM32\schtasks.exe
            "schtasks.exe" /Create /TN "UsbCeip_3ad33ee7" /XML "C:\Users\Admin\AppData\Local\Temp\cf87b401-2603-4e4b-80d6-cb0247b68334.xml" /F
            2⤵
            • Scheduled Task/Job: Scheduled Task
            PID:4652
          • C:\Windows\SYSTEM32\schtasks.exe
            "schtasks.exe" /Delete /TN "StartupAppTask_90f77706" /F
            2⤵
              PID:2460
            • C:\Windows\SYSTEM32\schtasks.exe
              "schtasks.exe" /Create /TN "StartupAppTask_90f77706" /XML "C:\Users\Admin\AppData\Local\Temp\f9990324-fddc-4d3c-8a9c-c49f8f1e2a90.xml" /F
              2⤵
              • Scheduled Task/Job: Scheduled Task
              PID:4944
            • C:\Windows\SYSTEM32\schtasks.exe
              "schtasks.exe" /Delete /TN "FamilySafetyMonitor_97d47e98" /F
              2⤵
                PID:1352
              • C:\Windows\SYSTEM32\schtasks.exe
                "schtasks.exe" /Create /TN "FamilySafetyMonitor_97d47e98" /XML "C:\Users\Admin\AppData\Local\Temp\182f418a-7b4a-4dfb-a1cc-9f943fe546f0.xml" /F
                2⤵
                • Scheduled Task/Job: Scheduled Task
                PID:4312
              • C:\Windows\SYSTEM32\schtasks.exe
                "schtasks.exe" /Delete /TN "NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_600844e7" /F
                2⤵
                  PID:1772
                • C:\Windows\SYSTEM32\schtasks.exe
                  "schtasks.exe" /Create /TN "NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_600844e7" /XML "C:\Users\Admin\AppData\Local\Temp\92010ac2-6975-4e19-8c35-9e96e8f2972f.xml" /F
                  2⤵
                  • Scheduled Task/Job: Scheduled Task
                  PID:3564
              • C:\Users\Admin\AppData\Local\Temp\2026-08-05_711eb910a1f0170c4c64aacd343929f2_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
                C:\Users\Admin\AppData\Local\Temp\2026-08-05_711eb910a1f0170c4c64aacd343929f2_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
                1⤵
                • Modifies data under HKEY_USERS
                • Suspicious use of AdjustPrivilegeToken
                PID:3560

              Network

                    MITRE ATT&CK Enterprise v16

                    Reconnaissance

                    Resource Development

                    Initial Access

                    Execution

                    Command and Scripting Interpreter

                    1
                    T1059

                    Windows Command Shell

                    1
                    T1059.003

                    Scheduled Task/Job

                    1
                    T1053

                    Scheduled Task

                    1
                    T1053.005

                    System Services

                    2
                    T1569

                    Service Execution

                    2
                    T1569.002

                    Persistence

                    Create or Modify System Process

                    5
                    T1543

                    Windows Service

                    5
                    T1543.003

                    Event Triggered Execution

                    1
                    T1546

                    Netsh Helper DLL

                    1
                    T1546.007

                    Scheduled Task/Job

                    1
                    T1053

                    Scheduled Task

                    1
                    T1053.005

                    Privilege Escalation

                    Abuse Elevation Control Mechanism

                    1
                    T1548

                    Bypass User Account Control

                    1
                    T1548.002

                    Create or Modify System Process

                    5
                    T1543

                    Windows Service

                    5
                    T1543.003

                    Event Triggered Execution

                    1
                    T1546

                    Netsh Helper DLL

                    1
                    T1546.007

                    Scheduled Task/Job

                    1
                    T1053

                    Scheduled Task

                    1
                    T1053.005

                    Defense Evasion

                    Abuse Elevation Control Mechanism

                    1
                    T1548

                    Bypass User Account Control

                    1
                    T1548.002

                    Impair Defenses

                    6
                    T1562

                    Disable or Modify System Firewall

                    1
                    T1562.004

                    Disable or Modify Tools

                    4
                    T1562.001

                    Modify Registry

                    5
                    T1112

                    Credential Access

                    Discovery

                    Query Registry

                    1
                    T1012

                    System Information Discovery

                    1
                    T1082

                    System Network Configuration Discovery

                    1
                    T1016

                    Internet Connection Discovery

                    1
                    T1016.001

                    Lateral Movement

                    Collection

                    Command and Control

                    Exfiltration

                    Impact

                    Service Stop

                    1
                    T1489

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    SearchUI.exe
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\SearchUI.exe
                    • Size 445KB
                    • SHA256 62ecf97310224ebabdae83b722c5047073269c1d87294860a2c0da43f1a80259
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    182f418a-7b4a-4dfb-a1cc-9f943fe546f0.xml
                    • Path C:\Users\Admin\AppData\Local\Temp\182f418a-7b4a-4dfb-a1cc-9f943fe546f0.xml
                    • Size 3KB
                    • SHA256 3f1fa007298af928aa498ff3c632d49ab6e4c92fd050ffc0ef36adb2c9f9ae0f
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    92010ac2-6975-4e19-8c35-9e96e8f2972f.xml
                    • Path C:\Users\Admin\AppData\Local\Temp\92010ac2-6975-4e19-8c35-9e96e8f2972f.xml
                    • Size 3KB
                    • SHA256 3df96a1691dad532ab089649806638044bac9684ebd7096666f8af1fcaf50258
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    b685af65-c03e-4f06-99ca-0949aab535da.xml
                    • Path C:\Users\Admin\AppData\Local\Temp\b685af65-c03e-4f06-99ca-0949aab535da.xml
                    • Size 3KB
                    • SHA256 89f654bc0d499e8210ba1d72f7b3446bc5bc4d377aab108b429bf8bed5b966fa
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    cf87b401-2603-4e4b-80d6-cb0247b68334.xml
                    • Path C:\Users\Admin\AppData\Local\Temp\cf87b401-2603-4e4b-80d6-cb0247b68334.xml
                    • Size 3KB
                    • SHA256 d868fb1253e55958f8852d76a9fd7a4596087952f6aee70bd712b4ced169cec1
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    e016e066-572e-4eb6-a0ec-d8693dcd1ee7.xml
                    • Path C:\Users\Admin\AppData\Local\Temp\e016e066-572e-4eb6-a0ec-d8693dcd1ee7.xml
                    • Size 3KB
                    • SHA256 25049fd46a92a585307190724986f9f0c53325166ad8315e2f9486193dd7d064
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    f9990324-fddc-4d3c-8a9c-c49f8f1e2a90.xml
                    • Path C:\Users\Admin\AppData\Local\Temp\f9990324-fddc-4d3c-8a9c-c49f8f1e2a90.xml
                    • Size 3KB
                    • SHA256 30dd787b948b8d0631be1d3a26f09f8b7867a05694b78906757ea0517915266a
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    memory/1152-0-0x000001FD70DB0000-0x000001FD70E24000-memory.dmp
                    Download

                    memory/1152-1-0x000001FD72CF0000-0x000001FD72D00000-memory.dmp
                    Download

                    memory/1152-2-0x000001FD72CF0000-0x000001FD72D00000-memory.dmp
                    Download