Analysis
- max time kernel
149s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
30/09/2026, 18:46
General
- Target 2026-09-29_8b21e75837ea784b490653da941ef42b_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
- Size 445KB
- Sample260930-xeszhsvxav
- SHA256 3098e64b14ad6e768cad6f45b19cb46212751eea3d15d9b663e31d27054f5182
Malware Config
Signatures
- Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Detects Sheetrat Payload 2 IoCs
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
- UAC bypass 3 TTPs 4 IoCs
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 2 IoCs
- Detects executables (downlaoders) containing URLs to raw contents of a paste 2 IoCs
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen 2 IoCs
- Modifies Windows Firewall 2 TTPs 1 IoCs
- Creates new service(s) 2 TTPs
- Executes a file named after a Windows system binary 1 TTPs 2 IoCs
The file runs from a user directory while carrying the name of an executable that normally only exists in System32.
- Executes dropped EXE 1 IoCs
- Stops running service(s) 4 TTPs
- Checks whether UAC is enabled 1 TTPs 2 IoCs
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Modifies data under HKEY_USERS 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
- System policy modification 1 TTPs 6 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_8b21e75837ea784b490653da941ef42b_amadey_cobalt-strike_darkgate_glassworm_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_8b21e75837ea784b490653da941ef42b_amadey_cobalt-strike_darkgate_glassworm_icedid.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Executes a file named after a Windows system binary
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\2026-09-29_8b21e75837ea784b490653da941ef42b_amadey_cobalt-strike_darkgate_glassworm_icedid.exe" enable=yes & exit2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\2026-09-29_8b21e75837ea784b490653da941ef42b_amadey_cobalt-strike_darkgate_glassworm_icedid.exe" enable=yes3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete "WindowsUpdaterDefenderMicrosoft"2⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-09-29_8b21e75837ea784b490653da941ef42b_amadey_cobalt-strike_darkgate_glassworm_icedid.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"2⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" start "WindowsUpdaterDefenderMicrosoft"2⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "DropboxUpdateTaskMachineCore_ed8b12dc" /F2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "DropboxUpdateTaskMachineCore_ed8b12dc" /XML "C:\Users\Admin\AppData\Local\Temp\0c68eee6-c7d3-49e2-a671-77e55ea4b064.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "FamilySafetyMonitor_72b93a9a" /F2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "FamilySafetyMonitor_72b93a9a" /XML "C:\Users\Admin\AppData\Local\Temp\2d4dc803-f7e3-4faf-86bf-99443b7f9c4f.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "Adobe Acrobat Update Task_01ed21c5" /F2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "Adobe Acrobat Update Task_01ed21c5" /XML "C:\Users\Admin\AppData\Local\Temp\7a8a16be-9f8d-4173-a522-a078a7c32414.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "SystemSoundsService_9b268201" /F2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "SystemSoundsService_9b268201" /XML "C:\Users\Admin\AppData\Local\Temp\356be292-0fbb-4b08-b403-fdf8846c49da.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "Consolidator_634618cc" /F2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "Consolidator_634618cc" /XML "C:\Users\Admin\AppData\Local\Temp\64e24c56-c8b3-4fb5-88e8-6f7f591729e8.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "MicrosoftEdgeUpdateTaskMachineCore_8ea26b08" /F2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "MicrosoftEdgeUpdateTaskMachineCore_8ea26b08" /XML "C:\Users\Admin\AppData\Local\Temp\e77e697c-0739-408c-95ea-015a900394bd.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_8b21e75837ea784b490653da941ef42b_amadey_cobalt-strike_darkgate_glassworm_icedid.exeC:\Users\Admin\AppData\Local\Temp\2026-09-29_8b21e75837ea784b490653da941ef42b_amadey_cobalt-strike_darkgate_glassworm_icedid.exe1⤵
- Reads the TCP/IP host and domain name from the registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\dllhost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\dllhost.exe"1⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Persistence
Create or Modify System Process
4Windows Service
4Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
4Windows Service
4Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
2Masquerading
1Match Legitimate Name or Location
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
0c68eee6-c7d3-49e2-a671-77e55ea4b064.xml
2d4dc803-f7e3-4faf-86bf-99443b7f9c4f.xml
356be292-0fbb-4b08-b403-fdf8846c49da.xml
64e24c56-c8b3-4fb5-88e8-6f7f591729e8.xml
7a8a16be-9f8d-4173-a522-a078a7c32414.xml
e77e697c-0739-408c-95ea-015a900394bd.xml
dllhost.exe
memory/2084-5-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp
memory/2084-8-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp
memory/2084-9-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp
memory/2084-7-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp
memory/2084-6-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp
memory/2084-0-0x000002A59AAA0000-0x000002A59AB14000-memory.dmp
memory/2084-4-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp
memory/2084-3-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp
memory/2084-20-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp
memory/2084-2-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp
memory/2084-1-0x00007FFF15F2F000-0x00007FFF15F30000-memory.dmp
memory/2084-24-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp
memory/2084-25-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp