Overview

overview

10

Static

static

10

2026-09-29...id.exe

windows10-2004-x64

10

2026-09-29...id.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    30/09/2026, 18:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-29_8b21e75837ea784b490653da941ef42b_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
  • Size 445KB
  • Sample260930-xeszhsvxav
  • SHA256 3098e64b14ad6e768cad6f45b19cb46212751eea3d15d9b663e31d27054f5182
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryevasionexecutionsheetratpersistenceprivilege_escalationtrojan

Malware Config

Signatures

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat
  • Detects Sheetrat Payload 2 IoCs

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs
    evasiontrojan
  • UAC bypass 3 TTPs 4 IoCs
    defense_evasiontrojan
  • Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 2 IoCs
  • Detects executables (downlaoders) containing URLs to raw contents of a paste 2 IoCs
  • Detects executables embedding registry key / value combination indicative of disabling Windows Defen 2 IoCs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    defense_evasion
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Executes a file named after a Windows system binary 1 TTPs 1 IoCs

    The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

    defense_evasion
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Windows security modification 2 TTPs 1 IoCs
    defense_evasiontrojan
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    defense_evasiontrojan
  • Looks up external IP address via web service 1 TTPs 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Modifies data under HKEY_USERS 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs
  • System policy modification 1 TTPs 6 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_8b21e75837ea784b490653da941ef42b_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_8b21e75837ea784b490653da941ef42b_amadey_cobalt-strike_darkgate_glassworm_icedid.exe"
    1⤵
    • Modifies Windows Defender DisableAntiSpyware settings
    • Modifies Windows Defender TamperProtection settings
    • UAC bypass
    • Executes a file named after a Windows system binary
    • Windows security modification
    • Checks whether UAC is enabled
    • Reads the TCP/IP host and domain name from the registry
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:4240
    • C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\2026-09-29_8b21e75837ea784b490653da941ef42b_amadey_cobalt-strike_darkgate_glassworm_icedid.exe" enable=yes & exit
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:3784
      • C:\Windows\system32\netsh.exe
        netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\2026-09-29_8b21e75837ea784b490653da941ef42b_amadey_cobalt-strike_darkgate_glassworm_icedid.exe" enable=yes
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        PID:4656
    • C:\Windows\SYSTEM32\sc.exe
      "sc.exe" delete "WindowsUpdaterDefenderMicrosoft"
      2⤵
      • Launches sc.exe
      PID:4528
    • C:\Windows\SYSTEM32\sc.exe
      "sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-09-29_8b21e75837ea784b490653da941ef42b_amadey_cobalt-strike_darkgate_glassworm_icedid.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"
      2⤵
      • Launches sc.exe
      PID:1644
    • C:\Windows\SYSTEM32\sc.exe
      "sc.exe" start "WindowsUpdaterDefenderMicrosoft"
      2⤵
      • Launches sc.exe
      PID:1252
    • C:\Windows\SYSTEM32\schtasks.exe
      "schtasks.exe" /Delete /TN "NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_dd33a2e9" /F
      2⤵
        PID:2740
      • C:\Windows\SYSTEM32\schtasks.exe
        "schtasks.exe" /Create /TN "NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_dd33a2e9" /XML "C:\Users\Admin\AppData\Local\Temp\b09d9bfb-c564-43f0-8207-84f5f314bc93.xml" /F
        2⤵
        • Scheduled Task/Job: Scheduled Task
        PID:756
      • C:\Windows\SYSTEM32\schtasks.exe
        "schtasks.exe" /Delete /TN "UsbCeip_37fc173e" /F
        2⤵
          PID:4636
        • C:\Windows\SYSTEM32\schtasks.exe
          "schtasks.exe" /Create /TN "UsbCeip_37fc173e" /XML "C:\Users\Admin\AppData\Local\Temp\bc263898-86de-4928-b888-9df59dccbe3d.xml" /F
          2⤵
          • Scheduled Task/Job: Scheduled Task
          PID:2824
        • C:\Windows\SYSTEM32\schtasks.exe
          "schtasks.exe" /Delete /TN "UsbCeip_82327f42" /F
          2⤵
            PID:1788
          • C:\Windows\SYSTEM32\schtasks.exe
            "schtasks.exe" /Create /TN "UsbCeip_82327f42" /XML "C:\Users\Admin\AppData\Local\Temp\eac95eca-5c70-4b47-9821-027cfe651e50.xml" /F
            2⤵
            • Scheduled Task/Job: Scheduled Task
            PID:4612
          • C:\Windows\SYSTEM32\schtasks.exe
            "schtasks.exe" /Delete /TN "Adobe Acrobat Update Task_55fffef6" /F
            2⤵
              PID:3392
            • C:\Windows\SYSTEM32\schtasks.exe
              "schtasks.exe" /Create /TN "Adobe Acrobat Update Task_55fffef6" /XML "C:\Users\Admin\AppData\Local\Temp\c5805f4f-81ae-4e5f-8697-ec63f98a5ba1.xml" /F
              2⤵
              • Scheduled Task/Job: Scheduled Task
              PID:5016
            • C:\Windows\SYSTEM32\schtasks.exe
              "schtasks.exe" /Delete /TN "Adobe Acrobat Update Task_2d3d3ad2" /F
              2⤵
                PID:2384
              • C:\Windows\SYSTEM32\schtasks.exe
                "schtasks.exe" /Create /TN "Adobe Acrobat Update Task_2d3d3ad2" /XML "C:\Users\Admin\AppData\Local\Temp\0af5fed2-a1ff-478e-a23b-ec05a01e0b70.xml" /F
                2⤵
                • Scheduled Task/Job: Scheduled Task
                PID:4600
              • C:\Windows\SYSTEM32\schtasks.exe
                "schtasks.exe" /Delete /TN "FamilySafetyRefreshTask_b890ee51" /F
                2⤵
                  PID:2124
                • C:\Windows\SYSTEM32\schtasks.exe
                  "schtasks.exe" /Create /TN "FamilySafetyRefreshTask_b890ee51" /XML "C:\Users\Admin\AppData\Local\Temp\b0afa7b5-071b-4c22-bfd8-3b803bf2f003.xml" /F
                  2⤵
                  • Scheduled Task/Job: Scheduled Task
                  PID:1524
              • C:\Users\Admin\AppData\Local\Temp\2026-09-29_8b21e75837ea784b490653da941ef42b_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
                C:\Users\Admin\AppData\Local\Temp\2026-09-29_8b21e75837ea784b490653da941ef42b_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
                1⤵
                • Reads the TCP/IP host and domain name from the registry
                • Modifies data under HKEY_USERS
                • Suspicious use of AdjustPrivilegeToken
                PID:3044

              Network

                    MITRE ATT&CK Enterprise v16

                    Reconnaissance

                    Resource Development

                    Initial Access

                    Execution

                    Command and Scripting Interpreter

                    1
                    T1059

                    Windows Command Shell

                    1
                    T1059.003

                    Scheduled Task/Job

                    1
                    T1053

                    Scheduled Task

                    1
                    T1053.005

                    System Services

                    2
                    T1569

                    Service Execution

                    2
                    T1569.002

                    Persistence

                    Create or Modify System Process

                    5
                    T1543

                    Windows Service

                    5
                    T1543.003

                    Event Triggered Execution

                    1
                    T1546

                    Netsh Helper DLL

                    1
                    T1546.007

                    Scheduled Task/Job

                    1
                    T1053

                    Scheduled Task

                    1
                    T1053.005

                    Privilege Escalation

                    Abuse Elevation Control Mechanism

                    1
                    T1548

                    Bypass User Account Control

                    1
                    T1548.002

                    Create or Modify System Process

                    5
                    T1543

                    Windows Service

                    5
                    T1543.003

                    Event Triggered Execution

                    1
                    T1546

                    Netsh Helper DLL

                    1
                    T1546.007

                    Scheduled Task/Job

                    1
                    T1053

                    Scheduled Task

                    1
                    T1053.005

                    Defense Evasion

                    Abuse Elevation Control Mechanism

                    1
                    T1548

                    Bypass User Account Control

                    1
                    T1548.002

                    Impair Defenses

                    6
                    T1562

                    Disable or Modify System Firewall

                    1
                    T1562.004

                    Disable or Modify Tools

                    4
                    T1562.001

                    Masquerading

                    1
                    T1036

                    Match Legitimate Name or Location

                    1
                    T1036.005

                    Modify Registry

                    5
                    T1112

                    Credential Access

                    Discovery

                    Query Registry

                    1
                    T1012

                    System Information Discovery

                    1
                    T1082

                    System Network Configuration Discovery

                    2
                    T1016

                    Internet Connection Discovery

                    1
                    T1016.001

                    Lateral Movement

                    Collection

                    Command and Control

                    Exfiltration

                    Impact

                    Service Stop

                    1
                    T1489

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    BackgroundTaskHost.exe
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\History\BackgroundTaskHost.exe
                    • Size 445KB
                    • SHA256 3098e64b14ad6e768cad6f45b19cb46212751eea3d15d9b663e31d27054f5182
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    0af5fed2-a1ff-478e-a23b-ec05a01e0b70.xml
                    • Path C:\Users\Admin\AppData\Local\Temp\0af5fed2-a1ff-478e-a23b-ec05a01e0b70.xml
                    • Size 3KB
                    • SHA256 7d4306ad82386a20cc1113ab6789ba4a9b545fd2eb1d6c48e7f8684d3323b0f5
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    b09d9bfb-c564-43f0-8207-84f5f314bc93.xml
                    • Path C:\Users\Admin\AppData\Local\Temp\b09d9bfb-c564-43f0-8207-84f5f314bc93.xml
                    • Size 3KB
                    • SHA256 13d3e69ae0b2c034bcbde996a0388c73a0745b3d364e59398a80508d64dc5d00
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    b0afa7b5-071b-4c22-bfd8-3b803bf2f003.xml
                    • Path C:\Users\Admin\AppData\Local\Temp\b0afa7b5-071b-4c22-bfd8-3b803bf2f003.xml
                    • Size 3KB
                    • SHA256 f61b5ffce3c7fb19ded270da47f3744869542be02a8779a4164ddf404631e0b9
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    bc263898-86de-4928-b888-9df59dccbe3d.xml
                    • Path C:\Users\Admin\AppData\Local\Temp\bc263898-86de-4928-b888-9df59dccbe3d.xml
                    • Size 3KB
                    • SHA256 ca8cb9c2bb0c0b1a461836c73fd41edfd0b164c9bb155467805659fd39be1ead
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    c5805f4f-81ae-4e5f-8697-ec63f98a5ba1.xml
                    • Path C:\Users\Admin\AppData\Local\Temp\c5805f4f-81ae-4e5f-8697-ec63f98a5ba1.xml
                    • Size 3KB
                    • SHA256 a92dbb86de4c39a0a8c18c43d4b7073f04dfddc815af242a4c4b073248e8318a
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    eac95eca-5c70-4b47-9821-027cfe651e50.xml
                    • Path C:\Users\Admin\AppData\Local\Temp\eac95eca-5c70-4b47-9821-027cfe651e50.xml
                    • Size 3KB
                    • SHA256 d04b817ae88ab7d03f08da9dd7506736317575144c0f6518390c3dea0614a5c7
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    memory/4240-0-0x000002503F140000-0x000002503F1B4000-memory.dmp
                    Download

                    memory/4240-1-0x00000250597A0000-0x00000250597B0000-memory.dmp
                    Download

                    memory/4240-86-0x00000250597A0000-0x00000250597B0000-memory.dmp
                    Download