Overview

overview

10

Static

static

10

2026-09-08...id.exe

windows10-2004-x64

10

2026-09-08...id.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/09/2026, 10:36

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-08_f0fae61294f9f0a66ee60a203f4540f8_amadey_darkgate_glassworm_icedid.exe
  • Size 3.0MB
  • Sample260908-mnes5sybnd
  • SHA256 6659bd8426629feb5b6b047be24ecd3cfdcc032016a9ab277d4da1e4d71420cf
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryevasionexecutionsheetratpersistenceprivilege_escalationtrojan

Malware Config

Signatures

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat
  • Detects Sheetrat Payload 1 IoCs

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 2 IoCs
    evasiontrojan
  • UAC bypass 3 TTPs 8 IoCs
    defense_evasiontrojan
  • Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 1 IoCs
  • Detects executables (downlaoders) containing URLs to raw contents of a paste 1 IoCs
  • Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
  • Modifies Windows Firewall 2 TTPs 2 IoCs
    defense_evasion
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 1 IoCs
  • Registers new Windows logon scripts automatically executed at logon. 1 TTPs 2 IoCs
    persistence
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
    defense_evasiontrojan
  • Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service 1 TTPs 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • Launches sc.exe 6 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 15 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 23 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 12 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_f0fae61294f9f0a66ee60a203f4540f8_amadey_darkgate_glassworm_icedid.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_f0fae61294f9f0a66ee60a203f4540f8_amadey_darkgate_glassworm_icedid.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies Windows Defender DisableAntiSpyware settings
    • UAC bypass
    • Registers new Windows logon scripts automatically executed at logon.
    • Checks whether UAC is enabled
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:4084
    • C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\2026-09-08_f0fae61294f9f0a66ee60a203f4540f8_amadey_darkgate_glassworm_icedid.exe" enable=yes & exit
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1668
      • C:\Windows\system32\netsh.exe
        netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\2026-09-08_f0fae61294f9f0a66ee60a203f4540f8_amadey_darkgate_glassworm_icedid.exe" enable=yes
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        PID:4460
    • C:\Windows\SYSTEM32\sc.exe
      "sc.exe" delete "WindowsUpdaterDefenderMicrosoft"
      2⤵
      • Launches sc.exe
      PID:4584
    • C:\Windows\SYSTEM32\sc.exe
      "sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-09-08_f0fae61294f9f0a66ee60a203f4540f8_amadey_darkgate_glassworm_icedid.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"
      2⤵
      • Launches sc.exe
      PID:2076
    • C:\Windows\SYSTEM32\sc.exe
      "sc.exe" start "WindowsUpdaterDefenderMicrosoft"
      2⤵
      • Launches sc.exe
      PID:4868
    • C:\Windows\SYSTEM32\schtasks.exe
      "schtasks.exe" /Delete /TN "SystemSoundsService_79fb09f9" /F
      2⤵
        PID:4504
      • C:\Windows\SYSTEM32\schtasks.exe
        "schtasks.exe" /Create /TN "SystemSoundsService_79fb09f9" /XML "C:\Users\Admin\AppData\Local\Temp\82dba57e-e66a-4bec-bf88-7953dcb88e56.xml" /F
        2⤵
        • Scheduled Task/Job: Scheduled Task
        PID:2368
      • C:\Windows\SYSTEM32\cmd.exe
        "cmd" /c schtasks /create /f /sc minute /mo 10 /tn "MicrosoftEdgeUpdate" /tr "C:\Windows\SysWOW64\autobfx.exe" /RL HIGHEST & exit
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:468
        • C:\Windows\system32\schtasks.exe
          schtasks /create /f /sc minute /mo 10 /tn "MicrosoftEdgeUpdate" /tr "C:\Windows\SysWOW64\autobfx.exe" /RL HIGHEST
          3⤵
          • Scheduled Task/Job: Scheduled Task
          PID:4816
      • C:\Windows\SYSTEM32\schtasks.exe
        "schtasks.exe" /Delete /TN "NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_5fed68f9" /F
        2⤵
          PID:3112
        • C:\Windows\SYSTEM32\CMD.exe
          "CMD" netsh advfirewall firewall add rule name="WindowsControl" dir=in action=allow program="C:\Windows\ShelIhost.exe" enable=yes & exit
          2⤵
            PID:3196
          • C:\Windows\SYSTEM32\CMD.exe
            "CMD" /c schtasks /delete /F /TN "ShelIhost" & exit
            2⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:2800
            • C:\Windows\system32\schtasks.exe
              schtasks /delete /F /TN "ShelIhost"
              3⤵
                PID:4920
            • C:\Windows\SYSTEM32\cmd.exe
              "cmd" /c schtasks /create /f /sc onlogon /tn "ShelIhost" /tr "C:\Windows\ShelIhost.exe" & exit
              2⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:3496
              • C:\Windows\system32\schtasks.exe
                schtasks /create /f /sc onlogon /tn "ShelIhost" /tr "C:\Windows\ShelIhost.exe"
                3⤵
                • Scheduled Task/Job: Scheduled Task
                PID:4236
            • C:\Windows\SYSTEM32\cmd.exe
              "cmd.exe" /c schtasks /create /f /tn "ShelIhost_OnLock" /tr "C:\Windows\ShelIhost.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
              2⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:2128
              • C:\Windows\system32\schtasks.exe
                schtasks /create /f /tn "ShelIhost_OnLock" /tr "C:\Windows\ShelIhost.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance"
                3⤵
                • Scheduled Task/Job: Scheduled Task
                PID:4728
            • C:\Windows\SYSTEM32\cmd.exe
              "cmd.exe" /c schtasks /create /f /tn "ShelIhost_OnUnlock" /tr "C:\Windows\ShelIhost.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
              2⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:2868
              • C:\Windows\system32\schtasks.exe
                schtasks /create /f /tn "ShelIhost_OnUnlock" /tr "C:\Windows\ShelIhost.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance"
                3⤵
                • Scheduled Task/Job: Scheduled Task
                PID:5800
            • C:\Windows\SYSTEM32\cmd.exe
              "cmd.exe" /c schtasks /create /f /tn "ShelIhost_OnIdle" /tr "C:\Windows\ShelIhost.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
              2⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:2700
              • C:\Windows\system32\schtasks.exe
                schtasks /create /f /tn "ShelIhost_OnIdle" /tr "C:\Windows\ShelIhost.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance"
                3⤵
                • Scheduled Task/Job: Scheduled Task
                PID:2160
            • C:\Windows\SYSTEM32\cmd.exe
              "cmd.exe" /c schtasks /create /f /tn "ShelIhost_Evt4624" /tr "C:\Windows\ShelIhost.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
              2⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:4064
              • C:\Windows\system32\schtasks.exe
                schtasks /create /f /tn "ShelIhost_Evt4624" /tr "C:\Windows\ShelIhost.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance"
                3⤵
                • Scheduled Task/Job: Scheduled Task
                PID:1628
            • C:\Windows\SYSTEM32\schtasks.exe
              "schtasks.exe" /Create /TN "NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_5fed68f9" /XML "C:\Users\Admin\AppData\Local\Temp\c66fcbb6-35ab-4156-97d7-8d4b7b4643ba.xml" /F
              2⤵
              • Scheduled Task/Job: Scheduled Task
              PID:1464
            • C:\Windows\SYSTEM32\schtasks.exe
              "schtasks.exe" /Delete /TN "Microsoft Compatibility Appraiser_34aa9db0" /F
              2⤵
                PID:1052
              • C:\Windows\SYSTEM32\schtasks.exe
                "schtasks.exe" /Create /TN "Microsoft Compatibility Appraiser_34aa9db0" /XML "C:\Users\Admin\AppData\Local\Temp\4354d8db-5a55-4b02-993e-966a83e9e369.xml" /F
                2⤵
                • Scheduled Task/Job: Scheduled Task
                PID:1952
              • C:\Windows\SYSTEM32\schtasks.exe
                "schtasks.exe" /Delete /TN "Consolidator_51e76d04" /F
                2⤵
                  PID:2260
                • C:\Windows\SYSTEM32\schtasks.exe
                  "schtasks.exe" /Create /TN "Consolidator_51e76d04" /XML "C:\Users\Admin\AppData\Local\Temp\84f03520-7ead-40e1-9430-96de70931439.xml" /F
                  2⤵
                  • Scheduled Task/Job: Scheduled Task
                  PID:3340
                • C:\Windows\SYSTEM32\schtasks.exe
                  "schtasks.exe" /Delete /TN "StartupAppTask_50acf37b" /F
                  2⤵
                    PID:2344
                  • C:\Windows\SYSTEM32\schtasks.exe
                    "schtasks.exe" /Create /TN "StartupAppTask_50acf37b" /XML "C:\Users\Admin\AppData\Local\Temp\c1ccdae6-c4e4-410c-be32-6cab0409ff05.xml" /F
                    2⤵
                    • Scheduled Task/Job: Scheduled Task
                    PID:2016
                  • C:\Windows\SYSTEM32\schtasks.exe
                    "schtasks.exe" /Delete /TN "Microsoft Compatibility Appraiser_1081b553" /F
                    2⤵
                      PID:5060
                    • C:\Windows\SYSTEM32\schtasks.exe
                      "schtasks.exe" /Create /TN "Microsoft Compatibility Appraiser_1081b553" /XML "C:\Users\Admin\AppData\Local\Temp\3db6f596-9c5c-4392-90e4-0762aa042362.xml" /F
                      2⤵
                      • Scheduled Task/Job: Scheduled Task
                      PID:6068
                    • C:\Windows\ShelIhost.exe
                      "C:\Windows\ShelIhost.exe"
                      2⤵
                      • Modifies Windows Defender DisableAntiSpyware settings
                      • UAC bypass
                      • Executes dropped EXE
                      • Registers new Windows logon scripts automatically executed at logon.
                      • Checks whether UAC is enabled
                      • Drops file in Windows directory
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      • System policy modification
                      PID:5748
                      • C:\Windows\SYSTEM32\cmd.exe
                        "cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\ShelIhost.exe" enable=yes & exit
                        3⤵
                        • Executes a command shell one-liner
                        • Suspicious use of WriteProcessMemory
                        PID:5772
                        • C:\Windows\system32\netsh.exe
                          netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\ShelIhost.exe" enable=yes
                          4⤵
                          • Modifies Windows Firewall
                          • Event Triggered Execution: Netsh Helper DLL
                          PID:4144
                      • C:\Windows\SYSTEM32\sc.exe
                        "sc.exe" delete "WindowsUpdaterDefenderMicrosoft"
                        3⤵
                        • Launches sc.exe
                        PID:5672
                      • C:\Windows\SYSTEM32\sc.exe
                        "sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\ShelIhost.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"
                        3⤵
                        • Launches sc.exe
                        PID:5820
                      • C:\Windows\SYSTEM32\sc.exe
                        "sc.exe" start "WindowsUpdaterDefenderMicrosoft"
                        3⤵
                        • Launches sc.exe
                        PID:4756
                      • C:\Windows\SYSTEM32\CMD.exe
                        "CMD" /c schtasks /delete /F /TN "ShelIhost" & exit
                        3⤵
                        • Executes a command shell one-liner
                        • Suspicious use of WriteProcessMemory
                        PID:2816
                        • C:\Windows\system32\schtasks.exe
                          schtasks /delete /F /TN "ShelIhost"
                          4⤵
                            PID:5136
                        • C:\Windows\SYSTEM32\cmd.exe
                          "cmd" /c schtasks /create /f /sc onlogon /tn "ShelIhost" /tr "C:\Windows\ShelIhost.exe" & exit
                          3⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:3260
                          • C:\Windows\system32\schtasks.exe
                            schtasks /create /f /sc onlogon /tn "ShelIhost" /tr "C:\Windows\ShelIhost.exe"
                            4⤵
                            • Scheduled Task/Job: Scheduled Task
                            PID:612
                        • C:\Windows\SYSTEM32\cmd.exe
                          "cmd.exe" /c schtasks /create /f /tn "ShelIhost_OnLock" /tr "C:\Windows\ShelIhost.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
                          3⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:200
                          • C:\Windows\system32\schtasks.exe
                            schtasks /create /f /tn "ShelIhost_OnLock" /tr "C:\Windows\ShelIhost.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance"
                            4⤵
                            • Scheduled Task/Job: Scheduled Task
                            PID:3408
                        • C:\Windows\SYSTEM32\cmd.exe
                          "cmd.exe" /c schtasks /create /f /tn "ShelIhost_OnUnlock" /tr "C:\Windows\ShelIhost.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
                          3⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:3808
                          • C:\Windows\system32\schtasks.exe
                            schtasks /create /f /tn "ShelIhost_OnUnlock" /tr "C:\Windows\ShelIhost.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance"
                            4⤵
                            • Scheduled Task/Job: Scheduled Task
                            PID:1196
                        • C:\Windows\SYSTEM32\cmd.exe
                          "cmd.exe" /c schtasks /create /f /tn "ShelIhost_OnIdle" /tr "C:\Windows\ShelIhost.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
                          3⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:2864
                          • C:\Windows\system32\schtasks.exe
                            schtasks /create /f /tn "ShelIhost_OnIdle" /tr "C:\Windows\ShelIhost.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance"
                            4⤵
                            • Scheduled Task/Job: Scheduled Task
                            PID:4372
                        • C:\Windows\SYSTEM32\cmd.exe
                          "cmd.exe" /c schtasks /create /f /tn "ShelIhost_Evt4624" /tr "C:\Windows\ShelIhost.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
                          3⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:3384
                          • C:\Windows\system32\schtasks.exe
                            schtasks /create /f /tn "ShelIhost_Evt4624" /tr "C:\Windows\ShelIhost.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance"
                            4⤵
                            • Scheduled Task/Job: Scheduled Task
                            PID:3352
                        • C:\Windows\SYSTEM32\schtasks.exe
                          "schtasks.exe" /Delete /TN "DropboxUpdateTaskMachineCore_a06666ee" /F
                          3⤵
                            PID:4368
                          • C:\Windows\SYSTEM32\schtasks.exe
                            "schtasks.exe" /Create /TN "DropboxUpdateTaskMachineCore_a06666ee" /XML "C:\Users\Admin\AppData\Local\Temp\0e5dd8ab-d686-465b-a5eb-7bcfb38ce525.xml" /F
                            3⤵
                            • Scheduled Task/Job: Scheduled Task
                            PID:5664
                          • C:\Windows\SYSTEM32\schtasks.exe
                            "schtasks.exe" /Delete /TN "NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_183c695a" /F
                            3⤵
                              PID:3240
                            • C:\Windows\SYSTEM32\schtasks.exe
                              "schtasks.exe" /Create /TN "NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_183c695a" /XML "C:\Users\Admin\AppData\Local\Temp\3dbdf7f1-810a-43f1-ab81-f3f7a961bdce.xml" /F
                              3⤵
                              • Scheduled Task/Job: Scheduled Task
                              PID:5652
                            • C:\Windows\SYSTEM32\schtasks.exe
                              "schtasks.exe" /Delete /TN "GoogleUpdateTaskMachineCore_ac526c2b" /F
                              3⤵
                                PID:2324
                              • C:\Windows\SYSTEM32\schtasks.exe
                                "schtasks.exe" /Create /TN "GoogleUpdateTaskMachineCore_ac526c2b" /XML "C:\Users\Admin\AppData\Local\Temp\ea68397a-4913-48c0-bce4-2e6774cc8b42.xml" /F
                                3⤵
                                • Scheduled Task/Job: Scheduled Task
                                PID:5824
                              • C:\Windows\SYSTEM32\schtasks.exe
                                "schtasks.exe" /Delete /TN "FamilySafetyMonitor_86417965" /F
                                3⤵
                                  PID:4180
                                • C:\Windows\SYSTEM32\schtasks.exe
                                  "schtasks.exe" /Create /TN "FamilySafetyMonitor_86417965" /XML "C:\Users\Admin\AppData\Local\Temp\43fd185e-0265-4cac-9607-581ed35ca852.xml" /F
                                  3⤵
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:4316
                                • C:\Windows\SYSTEM32\schtasks.exe
                                  "schtasks.exe" /Delete /TN "MicrosoftEdgeUpdateTaskMachineCore_be7178cf" /F
                                  3⤵
                                    PID:716
                                  • C:\Windows\SYSTEM32\schtasks.exe
                                    "schtasks.exe" /Create /TN "MicrosoftEdgeUpdateTaskMachineCore_be7178cf" /XML "C:\Users\Admin\AppData\Local\Temp\06a4732f-2dfc-4e80-8e2e-a8c92705bb9f.xml" /F
                                    3⤵
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:4828
                                  • C:\Windows\SYSTEM32\schtasks.exe
                                    "schtasks.exe" /Delete /TN "NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_240e0d5b" /F
                                    3⤵
                                      PID:2788
                                    • C:\Windows\SYSTEM32\schtasks.exe
                                      "schtasks.exe" /Create /TN "NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_240e0d5b" /XML "C:\Users\Admin\AppData\Local\Temp\f5b16a4f-733e-412c-bf66-c482da7a4920.xml" /F
                                      3⤵
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:4580
                                • C:\Users\Admin\AppData\Local\Temp\2026-09-08_f0fae61294f9f0a66ee60a203f4540f8_amadey_darkgate_glassworm_icedid.exe
                                  C:\Users\Admin\AppData\Local\Temp\2026-09-08_f0fae61294f9f0a66ee60a203f4540f8_amadey_darkgate_glassworm_icedid.exe
                                  1⤵
                                  • Modifies data under HKEY_USERS
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:5000
                                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\MusNotification.exe
                                  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\MusNotification.exe"
                                  1⤵
                                  • Executes dropped EXE
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:3752

                                Network

                                      MITRE ATT&CK Enterprise v16

                                      Reconnaissance

                                      Resource Development

                                      Initial Access

                                      Execution

                                      Command and Scripting Interpreter

                                      1
                                      T1059

                                      Windows Command Shell

                                      1
                                      T1059.003

                                      Scheduled Task/Job

                                      1
                                      T1053

                                      Scheduled Task

                                      1
                                      T1053.005

                                      System Services

                                      2
                                      T1569

                                      Service Execution

                                      2
                                      T1569.002

                                      Persistence

                                      Boot or Logon Autostart Execution

                                      1
                                      T1547

                                      Winlogon Helper DLL

                                      1
                                      T1547.004

                                      Boot or Logon Initialization Scripts

                                      1
                                      T1037

                                      Logon Script (Windows)

                                      1
                                      T1037.001

                                      Create or Modify System Process

                                      4
                                      T1543

                                      Windows Service

                                      4
                                      T1543.003

                                      Event Triggered Execution

                                      1
                                      T1546

                                      Netsh Helper DLL

                                      1
                                      T1546.007

                                      Scheduled Task/Job

                                      1
                                      T1053

                                      Scheduled Task

                                      1
                                      T1053.005

                                      Privilege Escalation

                                      Abuse Elevation Control Mechanism

                                      1
                                      T1548

                                      Bypass User Account Control

                                      1
                                      T1548.002

                                      Boot or Logon Autostart Execution

                                      1
                                      T1547

                                      Winlogon Helper DLL

                                      1
                                      T1547.004

                                      Boot or Logon Initialization Scripts

                                      1
                                      T1037

                                      Logon Script (Windows)

                                      1
                                      T1037.001

                                      Create or Modify System Process

                                      4
                                      T1543

                                      Windows Service

                                      4
                                      T1543.003

                                      Event Triggered Execution

                                      1
                                      T1546

                                      Netsh Helper DLL

                                      1
                                      T1546.007

                                      Scheduled Task/Job

                                      1
                                      T1053

                                      Scheduled Task

                                      1
                                      T1053.005

                                      Defense Evasion

                                      Abuse Elevation Control Mechanism

                                      1
                                      T1548

                                      Bypass User Account Control

                                      1
                                      T1548.002

                                      Impair Defenses

                                      4
                                      T1562

                                      Disable or Modify System Firewall

                                      1
                                      T1562.004

                                      Disable or Modify Tools

                                      2
                                      T1562.001

                                      Modify Registry

                                      4
                                      T1112

                                      Credential Access

                                      Discovery

                                      Query Registry

                                      1
                                      T1012

                                      System Information Discovery

                                      2
                                      T1082

                                      System Network Configuration Discovery

                                      1
                                      T1016

                                      Internet Connection Discovery

                                      1
                                      T1016.001

                                      Lateral Movement

                                      Collection

                                      Command and Control

                                      Web Service

                                      1
                                      T1102

                                      Exfiltration

                                      Impact

                                      Service Stop

                                      1
                                      T1489

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      06a4732f-2dfc-4e80-8e2e-a8c92705bb9f.xml
                                      • Path C:\Users\Admin\AppData\Local\Temp\06a4732f-2dfc-4e80-8e2e-a8c92705bb9f.xml
                                      • Size 3KB
                                      • SHA256 236038d175e04a9ad68e71cdd9777f852bd13c38d9a1932568431bedc8469b36
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      0e5dd8ab-d686-465b-a5eb-7bcfb38ce525.xml
                                      • Path C:\Users\Admin\AppData\Local\Temp\0e5dd8ab-d686-465b-a5eb-7bcfb38ce525.xml
                                      • Size 3KB
                                      • SHA256 45f2d3406a3bdac33a2135227a8806ef2a1c5568be02fd0187ef3fcfffc38300
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      3db6f596-9c5c-4392-90e4-0762aa042362.xml
                                      • Path C:\Users\Admin\AppData\Local\Temp\3db6f596-9c5c-4392-90e4-0762aa042362.xml
                                      • Size 3KB
                                      • SHA256 c4c26a6322f6b3343f7c6a1ba4b74f803e468a1c1649c017f2bfa221047b65ee
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      3dbdf7f1-810a-43f1-ab81-f3f7a961bdce.xml
                                      • Path C:\Users\Admin\AppData\Local\Temp\3dbdf7f1-810a-43f1-ab81-f3f7a961bdce.xml
                                      • Size 3KB
                                      • SHA256 a7ad50431434d79818369189780e6925113c38314481fdfcc497853fbd8b5dee
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      4354d8db-5a55-4b02-993e-966a83e9e369.xml
                                      • Path C:\Users\Admin\AppData\Local\Temp\4354d8db-5a55-4b02-993e-966a83e9e369.xml
                                      • Size 3KB
                                      • SHA256 dca18feeba9341c45f45d2cc0aaaea9f7e2cfde99b26e773e293e5b33837a786
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      43fd185e-0265-4cac-9607-581ed35ca852.xml
                                      • Path C:\Users\Admin\AppData\Local\Temp\43fd185e-0265-4cac-9607-581ed35ca852.xml
                                      • Size 3KB
                                      • SHA256 df78020cc0f73ec0c8e390f4725434925d4f16879cf082b13156ae631a4d1a6d
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      82dba57e-e66a-4bec-bf88-7953dcb88e56.xml
                                      • Path C:\Users\Admin\AppData\Local\Temp\82dba57e-e66a-4bec-bf88-7953dcb88e56.xml
                                      • Size 3KB
                                      • SHA256 ba105ec142694da6eaeaa9e636452252eb2bca8de4297dab6ca62fbfd665bd54
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      84f03520-7ead-40e1-9430-96de70931439.xml
                                      • Path C:\Users\Admin\AppData\Local\Temp\84f03520-7ead-40e1-9430-96de70931439.xml
                                      • Size 3KB
                                      • SHA256 6b5f0eed6cc97559b2f0b97fd4137588aa000abd3447c58f225d3076144c40a0
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      931785ca9df94789b7530bc37f5f42e9.dll
                                      • Path C:\Users\Admin\AppData\Local\Temp\931785ca9df94789b7530bc37f5f42e9.dll
                                      • Size 147KB
                                      • SHA256 ff95571a4b3880be2807cad8875ee6ccd0b2b705caf0d4d0d0f56950dd78ee5a
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      c1ccdae6-c4e4-410c-be32-6cab0409ff05.xml
                                      • Path C:\Users\Admin\AppData\Local\Temp\c1ccdae6-c4e4-410c-be32-6cab0409ff05.xml
                                      • Size 3KB
                                      • SHA256 43d1748f4732de0c947bce37363d547d82c9ef522a9282ac96681d3d3fd5899f
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      c66fcbb6-35ab-4156-97d7-8d4b7b4643ba.xml
                                      • Path C:\Users\Admin\AppData\Local\Temp\c66fcbb6-35ab-4156-97d7-8d4b7b4643ba.xml
                                      • Size 3KB
                                      • SHA256 d45d4d31e0760926c486aaed5aebf9ca3bdb1dd321513aaca1e7caea1f45f0f0
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      ea68397a-4913-48c0-bce4-2e6774cc8b42.xml
                                      • Path C:\Users\Admin\AppData\Local\Temp\ea68397a-4913-48c0-bce4-2e6774cc8b42.xml
                                      • Size 3KB
                                      • SHA256 1cdf207a0f5d575b9cf1a5c92696a779943a2aa1e40458ee3df2e3fc9d0add52
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      f5b16a4f-733e-412c-bf66-c482da7a4920.xml
                                      • Path C:\Users\Admin\AppData\Local\Temp\f5b16a4f-733e-412c-bf66-c482da7a4920.xml
                                      • Size 3KB
                                      • SHA256 66116c7bca14d8198797186aa64a36ff6528b40d0753f179eff9d8a4daa81705
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      memory/4084-9-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp
                                      Download

                                      memory/4084-1-0x00007FFDCD86F000-0x00007FFDCD870000-memory.dmp
                                      Download

                                      memory/4084-15-0x00007FFDEDDC0000-0x00007FFDEE161000-memory.dmp
                                      Download

                                      memory/4084-13-0x00007FFDF0520000-0x00007FFDF0783000-memory.dmp
                                      Download

                                      memory/4084-18-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp
                                      Download

                                      memory/4084-0-0x0000028191810000-0x00000281918BC000-memory.dmp
                                      Download

                                      memory/4084-21-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp
                                      Download

                                      memory/4084-22-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp
                                      Download

                                      memory/4084-12-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp
                                      Download

                                      memory/4084-2-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp
                                      Download

                                      memory/4084-11-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp
                                      Download

                                      memory/4084-3-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp
                                      Download

                                      memory/4084-10-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp
                                      Download

                                      memory/4084-14-0x00007FFDF0140000-0x00007FFDF0207000-memory.dmp
                                      Download

                                      memory/4084-8-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp
                                      Download

                                      memory/4084-7-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp
                                      Download

                                      memory/4084-81-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp
                                      Download

                                      memory/4084-4-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp
                                      Download

                                      memory/4084-5-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp
                                      Download

                                      memory/4084-6-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp
                                      Download

                                      memory/5748-83-0x00007FFDF0140000-0x00007FFDF0207000-memory.dmp
                                      Download

                                      memory/5748-84-0x00007FFDEDDC0000-0x00007FFDEE161000-memory.dmp
                                      Download

                                      memory/5748-82-0x00007FFDF0520000-0x00007FFDF0783000-memory.dmp
                                      Download

                                      memory/5780-68-0x00000000009A0000-0x00000000009A1000-memory.dmp
                                      Download

                                      memory/5780-37-0x00000000009C0000-0x00000000009C1000-memory.dmp
                                      Download

                                      memory/5780-20-0x00007FFDB0660000-0x00007FFDB0670000-memory.dmp
                                      Download