Analysis
- max time kernel
8s - max time network
11s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
01/10/2026, 17:37
Errors
General
- Target 2026-09-30_2024cdab99af677c0b34660597acaff2_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
- Size 376KB
- Sample261001-v7mxvswzcx
- SHA256 679c2f04992033c40f369510803be182398d72986e5ebb59da797da6aed5e93b
Malware Config
Signatures
- Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Detects Sheetrat Payload 1 IoCs
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 1 IoCs
- Detects executables (downlaoders) containing URLs to raw contents of a paste 1 IoCs
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-30_2024cdab99af677c0b34660597acaff2_amadey_cobalt-strike_darkgate_glassworm_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-30_2024cdab99af677c0b34660597acaff2_amadey_cobalt-strike_darkgate_glassworm_icedid.exe"1⤵
-
C:\Windows\SYSTEM32\sc.exe"sc" config WinDefend start= demand2⤵
- Launches sc.exe
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
dc506476-d4cc-4348-9375-8fed846bde0f.dll
memory/980-36-0x00007FFA33DE0000-0x00007FFA33DF0000-memory.dmp
memory/1032-210-0x00007FFA33DE0000-0x00007FFA33DF0000-memory.dmp
memory/1360-38-0x00007FFA33DE0000-0x00007FFA33DF0000-memory.dmp
memory/1588-224-0x00007FFA33DE0000-0x00007FFA33DF0000-memory.dmp
memory/1600-222-0x00007FFA33DE0000-0x00007FFA33DF0000-memory.dmp
memory/1736-108-0x00007FFA33DE0000-0x00007FFA33DF0000-memory.dmp
memory/2212-209-0x00007FFA33DE0000-0x00007FFA33DF0000-memory.dmp
memory/2400-8-0x00007FFA50D40000-0x00007FFA516E4000-memory.dmp
memory/2400-6-0x00007FFA50D40000-0x00007FFA516E4000-memory.dmp
memory/2400-10-0x00007FFA50D40000-0x00007FFA516E4000-memory.dmp
memory/2400-11-0x00007FFA50D40000-0x00007FFA516E4000-memory.dmp
memory/2400-12-0x00007FFA73CA0000-0x00007FFA73F03000-memory.dmp
memory/2400-13-0x00007FFA72F10000-0x00007FFA72FD7000-memory.dmp
memory/2400-14-0x00007FFA715A0000-0x00007FFA71941000-memory.dmp
memory/2400-16-0x00007FFA50D40000-0x00007FFA516E4000-memory.dmp
memory/2400-1-0x00007FFA50ECF000-0x00007FFA50ED0000-memory.dmp
memory/2400-0-0x000001A02E210000-0x000001A02E272000-memory.dmp
memory/2400-7-0x00007FFA50D40000-0x00007FFA516E4000-memory.dmp
memory/2400-9-0x00007FFA50D40000-0x00007FFA516E4000-memory.dmp
memory/2400-2-0x00007FFA50D40000-0x00007FFA516E4000-memory.dmp
memory/2400-3-0x00007FFA50D40000-0x00007FFA516E4000-memory.dmp
memory/2400-4-0x00007FFA50D40000-0x00007FFA516E4000-memory.dmp
memory/2400-5-0x00007FFA50D40000-0x00007FFA516E4000-memory.dmp
memory/2872-32-0x00007FFA33DE0000-0x00007FFA33DF0000-memory.dmp
memory/2964-221-0x00007FFA33DE0000-0x00007FFA33DF0000-memory.dmp
memory/3160-219-0x00007FFA33DE0000-0x00007FFA33DF0000-memory.dmp
memory/3552-223-0x00007FFA33DE0000-0x00007FFA33DF0000-memory.dmp
memory/3564-220-0x00007FFA33DE0000-0x00007FFA33DF0000-memory.dmp
memory/3572-225-0x00007FFA33DE0000-0x00007FFA33DF0000-memory.dmp
memory/4708-75-0x00007FFA33DE0000-0x00007FFA33DF0000-memory.dmp
memory/5288-53-0x00007FFA33DE0000-0x00007FFA33DF0000-memory.dmp