sheetrat | d3812d0e61b45fe5a4428d5f2e4da79f511516178c07eaba73b7f1d3eba37969

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	2026-08-23_0cbce3631456e8869ee158840dd008c5_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	2026-08-23_0cbce3631456e8869ee158840dd008c5_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	Cat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	Cat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	Cat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	Cat.exe

Modifies Windows Defender TamperProtection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	Cat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	2026-08-23_0cbce3631456e8869ee158840dd008c5_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	2026-08-23_0cbce3631456e8869ee158840dd008c5_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	Cat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	Cat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	Cat.exe

UAC bypass 3 TTPs 24 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Cat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	Cat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	Cat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Cat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	Cat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Cat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2026-08-23_0cbce3631456e8869ee158840dd008c5_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Cat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Cat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	Cat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2026-08-23_0cbce3631456e8869ee158840dd008c5_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	2026-08-23_0cbce3631456e8869ee158840dd008c5_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	2026-08-23_0cbce3631456e8869ee158840dd008c5_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2026-08-23_0cbce3631456e8869ee158840dd008c5_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Cat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Cat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Cat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Cat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-08-23_0cbce3631456e8869ee158840dd008c5_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Cat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Cat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Cat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-08-23_0cbce3631456e8869ee158840dd008c5_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2026-08-23_0cbce3631456e8869ee158840dd008c5_amadey_cobalt-strike_darkgate_glassworm_icedid.exe

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 2 IoCs

resource	yara_rule
behavioral1/memory/2816-0-0x00000267297F0000-0x0000026729858000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral1/files/0x0002000000022be0-6.dat	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

Detects executables (downlaoders) containing URLs to raw contents of a paste 2 IoCs

resource	yara_rule
behavioral1/memory/2816-0-0x00000267297F0000-0x0000026729858000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawPaste_URL
behavioral1/files/0x0002000000022be0-6.dat	INDICATOR_SUSPICIOUS_EXE_RawPaste_URL

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 2 IoCs

resource	yara_rule
behavioral1/memory/2816-0-0x00000267297F0000-0x0000026729858000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral1/files/0x0002000000022be0-6.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Modifies Windows Firewall 2 TTPs 6 IoCs

defense_evasion

Windows Service

Disable or Modify System Firewall

T1562.004

pid	Process
5040	netsh.exe
1948	netsh.exe
4032	netsh.exe
4772	netsh.exe
4460	netsh.exe
4000	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	2026-08-23_0cbce3631456e8869ee158840dd008c5_amadey_cobalt-strike_darkgate_glassworm_icedid.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 4 IoCs

pid	Process
4872	Cat.exe
1840	Cat.exe
1932	Cat.exe
3148	Cat.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Windows security modification 2 TTPs 6 IoCs

defense_evasion trojan

Disable or Modify Tools

Modify Registry

persistence privilege_escalation

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	2026-08-23_0cbce3631456e8869ee158840dd008c5_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	2026-08-23_0cbce3631456e8869ee158840dd008c5_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	Cat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	Cat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	Cat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	Cat.exe

Checks whether UAC is enabled 1 TTPs 12 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Cat.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Cat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Cat.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Cat.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-23_0cbce3631456e8869ee158840dd008c5_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Cat.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Cat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Cat.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-23_0cbce3631456e8869ee158840dd008c5_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-08-23_0cbce3631456e8869ee158840dd008c5_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-08-23_0cbce3631456e8869ee158840dd008c5_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Cat.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
8	ip-api.com

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Cat.exe.log	Cat.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\2026-08-23_0cbce3631456e8869ee158840dd008c5_amadey_cobalt-strike_darkgate_glassworm_icedid.exe.log	2026-08-23_0cbce3631456e8869ee158840dd008c5_amadey_cobalt-strike_darkgate_glassworm_icedid.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Cat.exe	2026-08-23_0cbce3631456e8869ee158840dd008c5_amadey_cobalt-strike_darkgate_glassworm_icedid.exe

Launches sc.exe 18 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
904	sc.exe
2388	sc.exe
1232	sc.exe
1972	sc.exe
4732	sc.exe
2952	sc.exe
600	sc.exe
1472	sc.exe
980	sc.exe
5112	sc.exe
1572	sc.exe
2152	sc.exe
212	sc.exe
4344	sc.exe
2248	sc.exe
4536	sc.exe
3888	sc.exe
3748	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 18 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 13 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2012	CMD.exe
1864	cmd.exe
2292	cmd.exe
4504	cmd.exe
4492	cmd.exe
4792	CMD.exe
4400	cmd.exe
2444	cmd.exe
4676	CMD.exe
2308	cmd.exe
1556	CMD.exe
1216	cmd.exe
5108	cmd.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Cat.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	2026-08-23_0cbce3631456e8869ee158840dd008c5_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	2026-08-23_0cbce3631456e8869ee158840dd008c5_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	2026-08-23_0cbce3631456e8869ee158840dd008c5_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Cat.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\gogoduck	2026-08-23_0cbce3631456e8869ee158840dd008c5_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	2026-08-23_0cbce3631456e8869ee158840dd008c5_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	2026-08-23_0cbce3631456e8869ee158840dd008c5_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	2026-08-23_0cbce3631456e8869ee158840dd008c5_amadey_cobalt-strike_darkgate_glassworm_icedid.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
5048	schtasks.exe
2108	schtasks.exe
4128	schtasks.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2816	2026-08-23_0cbce3631456e8869ee158840dd008c5_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Token: SeDebugPrivilege	3448	2026-08-23_0cbce3631456e8869ee158840dd008c5_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Token: SeDebugPrivilege	4872	Cat.exe
Token: SeDebugPrivilege	1840	Cat.exe
Token: SeDebugPrivilege	1932	Cat.exe
Token: SeDebugPrivilege	3148	Cat.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 5108	2816	2026-08-23_0cbce3631456e8869ee158840dd008c5_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	89
PID 5108 wrote to memory of 4460	5108	cmd.exe	91
PID 2816 wrote to memory of 4732	2816	2026-08-23_0cbce3631456e8869ee158840dd008c5_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	92
PID 2816 wrote to memory of 4344	2816	2026-08-23_0cbce3631456e8869ee158840dd008c5_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	94
PID 2816 wrote to memory of 2952	2816	2026-08-23_0cbce3631456e8869ee158840dd008c5_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	96
PID 3448 wrote to memory of 2444	3448	2026-08-23_0cbce3631456e8869ee158840dd008c5_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	100
PID 2444 wrote to memory of 4000	2444	cmd.exe	102
PID 3448 wrote to memory of 600	3448	2026-08-23_0cbce3631456e8869ee158840dd008c5_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	103
PID 3448 wrote to memory of 1232	3448	2026-08-23_0cbce3631456e8869ee158840dd008c5_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	105
PID 3448 wrote to memory of 212	3448	2026-08-23_0cbce3631456e8869ee158840dd008c5_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	107
PID 3448 wrote to memory of 3444	3448	2026-08-23_0cbce3631456e8869ee158840dd008c5_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	109
PID 3448 wrote to memory of 2012	3448	2026-08-23_0cbce3631456e8869ee158840dd008c5_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	110
PID 3448 wrote to memory of 1864	3448	2026-08-23_0cbce3631456e8869ee158840dd008c5_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	111
PID 2012 wrote to memory of 2824	2012	CMD.exe	115
PID 3448 wrote to memory of 4872	3448	2026-08-23_0cbce3631456e8869ee158840dd008c5_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	116
PID 1864 wrote to memory of 5048	1864	cmd.exe	117
PID 2816 wrote to memory of 4676	2816	2026-08-23_0cbce3631456e8869ee158840dd008c5_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	118
PID 2816 wrote to memory of 2292	2816	2026-08-23_0cbce3631456e8869ee158840dd008c5_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	119
PID 2816 wrote to memory of 1840	2816	2026-08-23_0cbce3631456e8869ee158840dd008c5_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	122
PID 2292 wrote to memory of 2108	2292	cmd.exe	123
PID 4676 wrote to memory of 4448	4676	CMD.exe	125
PID 4872 wrote to memory of 2308	4872	Cat.exe	130
PID 2308 wrote to memory of 5040	2308	cmd.exe	132
PID 4872 wrote to memory of 2248	4872	Cat.exe	133
PID 4872 wrote to memory of 1472	4872	Cat.exe	135
PID 4872 wrote to memory of 980	4872	Cat.exe	137
PID 1840 wrote to memory of 4504	1840	Cat.exe	138
PID 4504 wrote to memory of 1948	4504	cmd.exe	142
PID 1932 wrote to memory of 4492	1932	Cat.exe	143
PID 4492 wrote to memory of 4032	4492	cmd.exe	145
PID 1932 wrote to memory of 4536	1932	Cat.exe	146
PID 1932 wrote to memory of 5112	1932	Cat.exe	148
PID 1932 wrote to memory of 3888	1932	Cat.exe	150
PID 1840 wrote to memory of 3748	1840	Cat.exe	152
PID 1840 wrote to memory of 1572	1840	Cat.exe	154
PID 1932 wrote to memory of 4792	1932	Cat.exe	156
PID 1932 wrote to memory of 4400	1932	Cat.exe	157
PID 1840 wrote to memory of 904	1840	Cat.exe	160
PID 4792 wrote to memory of 2500	4792	CMD.exe	162
PID 4400 wrote to memory of 4128	4400	cmd.exe	163
PID 4872 wrote to memory of 1556	4872	Cat.exe	165
PID 1556 wrote to memory of 2564	1556	CMD.exe	167
PID 3148 wrote to memory of 1216	3148	Cat.exe	171
PID 1216 wrote to memory of 4772	1216	cmd.exe	173
PID 3148 wrote to memory of 1972	3148	Cat.exe	174
PID 3148 wrote to memory of 2152	3148	Cat.exe	176
PID 3148 wrote to memory of 2388	3148	Cat.exe	178

System policy modification 1 TTPs 36 IoCs

defense_evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-08-23_0cbce3631456e8869ee158840dd008c5_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	2026-08-23_0cbce3631456e8869ee158840dd008c5_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Cat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	Cat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Cat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "1"	Cat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Cat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "1"	Cat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	2026-08-23_0cbce3631456e8869ee158840dd008c5_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2026-08-23_0cbce3631456e8869ee158840dd008c5_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2026-08-23_0cbce3631456e8869ee158840dd008c5_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	Cat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "1"	2026-08-23_0cbce3631456e8869ee158840dd008c5_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "1"	2026-08-23_0cbce3631456e8869ee158840dd008c5_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "1"	Cat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Cat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-08-23_0cbce3631456e8869ee158840dd008c5_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	Cat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Cat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2026-08-23_0cbce3631456e8869ee158840dd008c5_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	2026-08-23_0cbce3631456e8869ee158840dd008c5_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Cat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	Cat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	Cat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Cat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	Cat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Cat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2026-08-23_0cbce3631456e8869ee158840dd008c5_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Cat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "1"	Cat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Cat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Cat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	Cat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	2026-08-23_0cbce3631456e8869ee158840dd008c5_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Cat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	Cat.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-23_0cbce3631456e8869ee158840dd008c5_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-23_0cbce3631456e8869ee158840dd008c5_amadey_cobalt-strike_darkgate_glassworm_icedid.exe"
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender TamperProtection settings
- UAC bypass
- Checks computer location settings
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2816
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\2026-08-23_0cbce3631456e8869ee158840dd008c5_amadey_cobalt-strike_darkgate_glassworm_icedid.exe" enable=yes & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5108
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\2026-08-23_0cbce3631456e8869ee158840dd008c5_amadey_cobalt-strike_darkgate_glassworm_icedid.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4460
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" delete "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:4732
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-08-23_0cbce3631456e8869ee158840dd008c5_amadey_cobalt-strike_darkgate_glassworm_icedid.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:4344
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" start "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:2952
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c schtasks /delete /F /TN "Cat" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4676
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /F /TN "Cat"
    3⤵
    PID:4448
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc onlogon /tn "Cat" /tr "C:\Windows\Cat.exe" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2292
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /tn "Cat" /tr "C:\Windows\Cat.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2108
- C:\Windows\Cat.exe
  "C:\Windows\Cat.exe"
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  - Modifies Windows Defender TamperProtection settings
  - UAC bypass
  - Executes dropped EXE
  - Windows security modification
  - Checks whether UAC is enabled
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1840
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\Cat.exe" enable=yes & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4504
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\Cat.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:1948
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete "WindowsUpdaterDefenderMicrosoft"
    3⤵
    - Launches sc.exe
    PID:3748
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\Cat.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"
    3⤵
    - Launches sc.exe
    PID:1572
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" start "WindowsUpdaterDefenderMicrosoft"
    3⤵
    - Launches sc.exe
    PID:904

C:\Users\Admin\AppData\Local\Temp\2026-08-23_0cbce3631456e8869ee158840dd008c5_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
C:\Users\Admin\AppData\Local\Temp\2026-08-23_0cbce3631456e8869ee158840dd008c5_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender TamperProtection settings
- UAC bypass
- Windows security modification
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3448
- C:\Windows\system32\cmd.exe
  "cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\2026-08-23_0cbce3631456e8869ee158840dd008c5_amadey_cobalt-strike_darkgate_glassworm_icedid.exe" enable=yes & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2444
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\2026-08-23_0cbce3631456e8869ee158840dd008c5_amadey_cobalt-strike_darkgate_glassworm_icedid.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4000
- C:\Windows\system32\sc.exe
  "sc.exe" delete "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:600
- C:\Windows\system32\sc.exe
  "sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-08-23_0cbce3631456e8869ee158840dd008c5_amadey_cobalt-strike_darkgate_glassworm_icedid.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:1232
- C:\Windows\system32\sc.exe
  "sc.exe" start "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:212
- C:\Windows\system32\CMD.exe
  "CMD" netsh advfirewall firewall add rule name="WindowsControl" dir=in action=allow program="C:\Windows\Cat.exe" enable=yes & exit
  2⤵
  PID:3444
- C:\Windows\system32\CMD.exe
  "CMD" /c schtasks /delete /F /TN "Cat" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2012
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /F /TN "Cat"
    3⤵
    PID:2824
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc onlogon /tn "Cat" /tr "C:\Windows\Cat.exe" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1864
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /tn "Cat" /tr "C:\Windows\Cat.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5048
- C:\Windows\Cat.exe
  "C:\Windows\Cat.exe"
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  - Modifies Windows Defender TamperProtection settings
  - UAC bypass
  - Executes dropped EXE
  - Windows security modification
  - Checks whether UAC is enabled
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4872
- - C:\Windows\system32\cmd.exe
    "cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\Cat.exe" enable=yes & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2308
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\Cat.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:5040
- - C:\Windows\system32\sc.exe
    "sc.exe" delete "WindowsUpdaterDefenderMicrosoft"
    3⤵
    - Launches sc.exe
    PID:2248
- - C:\Windows\system32\sc.exe
    "sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\Cat.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"
    3⤵
    - Launches sc.exe
    PID:1472
- - C:\Windows\system32\sc.exe
    "sc.exe" start "WindowsUpdaterDefenderMicrosoft"
    3⤵
    - Launches sc.exe
    PID:980
- - C:\Windows\system32\CMD.exe
    "CMD" /c schtasks /delete /F /TN "Cat" & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1556
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /F /TN "Cat"
      4⤵
      PID:2564

C:\Windows\Cat.exe
C:\Windows\Cat.exe
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender TamperProtection settings
- UAC bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1932
- C:\Windows\system32\cmd.exe
  "cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\Cat.exe" enable=yes & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4492
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\Cat.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4032
- C:\Windows\system32\sc.exe
  "sc.exe" delete "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:4536
- C:\Windows\system32\sc.exe
  "sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\Cat.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:5112
- C:\Windows\system32\sc.exe
  "sc.exe" start "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:3888
- C:\Windows\system32\CMD.exe
  "CMD" /c schtasks /delete /F /TN "Cat" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4792
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /F /TN "Cat"
    3⤵
    PID:2500
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc onlogon /tn "Cat" /tr "C:\Windows\Cat.exe" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4400
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /tn "Cat" /tr "C:\Windows\Cat.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4128

C:\Windows\Cat.exe
C:\Windows\Cat.exe
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender TamperProtection settings
- UAC bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3148
- C:\Windows\system32\cmd.exe
  "cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\Cat.exe" enable=yes & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1216
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\Cat.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4772
- C:\Windows\system32\sc.exe
  "sc.exe" delete "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:1972
- C:\Windows\system32\sc.exe
  "sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\Cat.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:2152
- C:\Windows\system32\sc.exe
  "sc.exe" start "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:2388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

Modify Registry