Analysis
- max time kernel
149s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
25/09/2026, 23:06
General
- Target 2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
- Size 420KB
- Sample260925-23ffjsyeld
- SHA256 a9fc96eb19d9c9e0ff632624aa221020eec1e4c3af5af9a546cef455dcdd085a
Malware Config
Signatures
- Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Detects Sheetrat Payload 1 IoCs
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
- UAC bypass 3 TTPs 4 IoCs
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 1 IoCs
- Detects executables (downlaoders) containing URLs to raw contents of a paste 1 IoCs
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
- Modifies Windows Firewall 2 TTPs 1 IoCs
- Executes dropped EXE 1 IoCs
- Stops running service(s) 4 TTPs
- Checks whether UAC is enabled 1 TTPs 2 IoCs
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious behavior: EnumeratesProcesses 18 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 35 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
- System policy modification 1 TTPs 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe" enable=yes & exit2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\2026-09-25_8da7b76568db1391edcecb2745951089_amadey_cobalt-strike_darkgate_glassworm_icedid.exe" enable=yes3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete "WindowsUpdaterDefenderMicrosoft"2⤵
- Launches sc.exe
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1System Services
1Service Execution
1Persistence
Create or Modify System Process
3Windows Service
3Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
3Windows Service
3Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
2Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
03302bc2fd404ecd9bc29b7b0f7ba43b.dll
memory/1948-16-0x00007FFC34B40000-0x00007FFC34B50000-memory.dmp
memory/2680-8-0x00007FFC52580000-0x00007FFC52F24000-memory.dmp
memory/2680-9-0x00007FFC74A00000-0x00007FFC74C63000-memory.dmp
memory/2680-4-0x00007FFC52580000-0x00007FFC52F24000-memory.dmp
memory/2680-5-0x00007FFC52580000-0x00007FFC52F24000-memory.dmp
memory/2680-6-0x00007FFC52580000-0x00007FFC52F24000-memory.dmp
memory/2680-7-0x00007FFC52580000-0x00007FFC52F24000-memory.dmp
memory/2680-0-0x000002246A100000-0x000002246A16E000-memory.dmp
memory/2680-3-0x00007FFC52580000-0x00007FFC52F24000-memory.dmp
memory/2680-10-0x00007FFC73B50000-0x00007FFC73C17000-memory.dmp
memory/2680-11-0x00007FFC724A0000-0x00007FFC72841000-memory.dmp
memory/2680-12-0x00007FFC52580000-0x00007FFC52F24000-memory.dmp
memory/2680-2-0x00007FFC52580000-0x00007FFC52F24000-memory.dmp
memory/2680-1-0x00007FFC5270F000-0x00007FFC52710000-memory.dmp
memory/2680-17-0x00007FFC52580000-0x00007FFC52F24000-memory.dmp