Analysis
- max time kernel
149s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
05/08/2026, 03:02
General
- Target 2026-08-05_711eb910a1f0170c4c64aacd343929f2_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
- Size 445KB
- Sample260805-djfeface46
- SHA256 62ecf97310224ebabdae83b722c5047073269c1d87294860a2c0da43f1a80259
Malware Config
Signatures
- Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Detects Sheetrat Payload 1 IoCs
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
- UAC bypass 3 TTPs 4 IoCs
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 1 IoCs
- Detects executables (downlaoders) containing URLs to raw contents of a paste 1 IoCs
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
- Modifies Windows Firewall 2 TTPs 1 IoCs
- Creates new service(s) 2 TTPs
- Stops running service(s) 4 TTPs
- Checks whether UAC is enabled 1 TTPs 2 IoCs
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Modifies data under HKEY_USERS 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
- System policy modification 1 TTPs 6 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_711eb910a1f0170c4c64aacd343929f2_amadey_cobalt-strike_darkgate_glassworm_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-05_711eb910a1f0170c4c64aacd343929f2_amadey_cobalt-strike_darkgate_glassworm_icedid.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\2026-08-05_711eb910a1f0170c4c64aacd343929f2_amadey_cobalt-strike_darkgate_glassworm_icedid.exe" enable=yes & exit2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\2026-08-05_711eb910a1f0170c4c64aacd343929f2_amadey_cobalt-strike_darkgate_glassworm_icedid.exe" enable=yes3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete "WindowsUpdaterDefenderMicrosoft"2⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-08-05_711eb910a1f0170c4c64aacd343929f2_amadey_cobalt-strike_darkgate_glassworm_icedid.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"2⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" start "WindowsUpdaterDefenderMicrosoft"2⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "StartupAppTask_72ed6299" /F2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "StartupAppTask_72ed6299" /XML "C:\Users\Admin\AppData\Local\Temp\ec759db8-ad42-4b44-b5ff-8017eb38d136.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_915ac63f" /F2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_915ac63f" /XML "C:\Users\Admin\AppData\Local\Temp\fc2417ca-0814-49e3-897e-33dd443a66db.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "Microsoft Compatibility Appraiser_11c15000" /F2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "Microsoft Compatibility Appraiser_11c15000" /XML "C:\Users\Admin\AppData\Local\Temp\4589aafc-7b94-48a8-8167-8d09404922c8.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "FamilySafetyMonitor_1cb88170" /F2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "FamilySafetyMonitor_1cb88170" /XML "C:\Users\Admin\AppData\Local\Temp\544259d4-e1a2-4cf0-bff0-88ea6298d70e.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "StartupAppTask_96e7db22" /F2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "StartupAppTask_96e7db22" /XML "C:\Users\Admin\AppData\Local\Temp\a1c77b9e-b030-4e34-8bac-5ffcc068bbd2.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "StartupAppTask_0d871f08" /F2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "StartupAppTask_0d871f08" /XML "C:\Users\Admin\AppData\Local\Temp\9215414f-0ef4-4e77-9a19-cd30839f45fc.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_711eb910a1f0170c4c64aacd343929f2_amadey_cobalt-strike_darkgate_glassworm_icedid.exeC:\Users\Admin\AppData\Local\Temp\2026-08-05_711eb910a1f0170c4c64aacd343929f2_amadey_cobalt-strike_darkgate_glassworm_icedid.exe1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Persistence
Create or Modify System Process
4Windows Service
4Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
4Windows Service
4Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
2Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
4589aafc-7b94-48a8-8167-8d09404922c8.xml
544259d4-e1a2-4cf0-bff0-88ea6298d70e.xml
9215414f-0ef4-4e77-9a19-cd30839f45fc.xml
a1c77b9e-b030-4e34-8bac-5ffcc068bbd2.xml
ec759db8-ad42-4b44-b5ff-8017eb38d136.xml
fc2417ca-0814-49e3-897e-33dd443a66db.xml
memory/3180-3-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp
memory/3180-7-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp
memory/3180-8-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp
memory/3180-6-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp
memory/3180-5-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp
memory/3180-4-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp
memory/3180-0-0x00007FFDBCE5F000-0x00007FFDBCE60000-memory.dmp
memory/3180-2-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp
memory/3180-1-0x000002094E430000-0x000002094E4A4000-memory.dmp