Analysis
- max time kernel
149s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
05/08/2026, 05:44
General
- Target 2026-08-05_8fa85fe496584a367c6c490bc0d5bd49_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
- Size 420KB
- Sample260805-gfdcfsec68
- SHA256 6a8bd1683f128d82ed97db8f32b22dcda2981975a47a475472054a89e7ed762f
Malware Config
Signatures
- Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Detects Sheetrat Payload 1 IoCs
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
- UAC bypass 3 TTPs 4 IoCs
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 1 IoCs
- Detects executables (downlaoders) containing URLs to raw contents of a paste 1 IoCs
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
- Executes dropped EXE 1 IoCs
- Checks whether UAC is enabled 1 TTPs 2 IoCs
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious behavior: EnumeratesProcesses 17 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 39 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
- System policy modification 1 TTPs 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_8fa85fe496584a367c6c490bc0d5bd49_amadey_cobalt-strike_darkgate_glassworm_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-05_8fa85fe496584a367c6c490bc0d5bd49_amadey_cobalt-strike_darkgate_glassworm_icedid.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /S2⤵
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
2Disable or Modify Tools
2Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
058937b556224d12aab954b879f6d422.dll
memory/3752-14-0x00007FFAA8DA0000-0x00007FFAA8DB0000-memory.dmp
memory/4716-6-0x00007FFAC5DE0000-0x00007FFAC6784000-memory.dmp
memory/4716-3-0x00007FFAC5DE0000-0x00007FFAC6784000-memory.dmp
memory/4716-4-0x00007FFAC5DE0000-0x00007FFAC6784000-memory.dmp
memory/4716-5-0x00007FFAC5DE0000-0x00007FFAC6784000-memory.dmp
memory/4716-0-0x000002ABB1F80000-0x000002ABB1FEE000-memory.dmp
memory/4716-7-0x00007FFAC5DE0000-0x00007FFAC6784000-memory.dmp
memory/4716-8-0x00007FFAE8C60000-0x00007FFAE8EC3000-memory.dmp
memory/4716-9-0x00007FFAE7770000-0x00007FFAE7837000-memory.dmp
memory/4716-10-0x00007FFAE6070000-0x00007FFAE6411000-memory.dmp
memory/4716-2-0x00007FFAC5DE0000-0x00007FFAC6784000-memory.dmp
memory/4716-1-0x00007FFAC5F6F000-0x00007FFAC5F70000-memory.dmp
memory/4716-15-0x00007FFAC5DE0000-0x00007FFAC6784000-memory.dmp