sheetrat | ed48366b763272463cbd8cb06e78bf3a7812a9516ac737efadbeb434c8d4283e

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\Speech_OneCore\\Engines\\TTS\\ru-RU\\M1004NUS.exe,"	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 3 IoCs

evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	BootExecutor.exe

Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	M1004NUS.exe

UAC bypass 3 TTPs 12 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	BootExecutor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	BootExecutor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	BootExecutor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	BootExecutor.exe

Custom signature

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 3 IoCs

resource	yara_rule
behavioral2/memory/2368-0-0x0000022EA1A70000-0x0000022EA1ADE000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/files/0x000d00000001c4ec-17.dat	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral2/memory/4656-77-0x00000200B3010000-0x00000200B307E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

Custom signature

Detects executables (downlaoders) containing URLs to raw contents of a paste 3 IoCs

resource	yara_rule
behavioral2/memory/2368-0-0x0000022EA1A70000-0x0000022EA1ADE000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawPaste_URL
behavioral2/files/0x000d00000001c4ec-17.dat	INDICATOR_SUSPICIOUS_EXE_RawPaste_URL
behavioral2/memory/4656-77-0x00000200B3010000-0x00000200B307E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawPaste_URL

Custom signature

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 3 IoCs

resource	yara_rule
behavioral2/memory/2368-0-0x0000022EA1A70000-0x0000022EA1ADE000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4ec-17.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/memory/4656-77-0x00000200B3010000-0x00000200B307E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
5324	bcdedit.exe
600	bcdedit.exe

Drops file in Drivers directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\parport.sys	M1004NUS.exe
File created	C:\Windows\system32\drivers\parport.sys	M1004NUS.exe
File created	C:\Windows\system32\drivers\serenum.sys	M1004NUS.exe
File opened for modification	C:\Windows\system32\drivers\serial.sys	M1004NUS.exe
File opened for modification	C:\Windows\system32\drivers\raspppoe.sys	M1004NUS.exe
File opened for modification	C:\Windows\system32\drivers\raspptp.sys	M1004NUS.exe
File opened for modification	C:\Windows\system32\drivers\serenum.sys	M1004NUS.exe
File created	C:\Windows\system32\drivers\serial.sys	M1004NUS.exe
File opened for modification	C:\Windows\system32\drivers\usbprint.sys	M1004NUS.exe
File created	C:\Windows\system32\drivers\usbprint.sys	M1004NUS.exe
File opened for modification	C:\Windows\system32\drivers\null.sys	M1004NUS.exe
File opened for modification	C:\Windows\system32\drivers\beep.sys	M1004NUS.exe
File opened for modification	C:\Windows\system32\drivers\rasl2tp.sys	M1004NUS.exe
File opened for modification	C:\Windows\system32\drivers\modem.sys	M1004NUS.exe

Modifies Windows Firewall 2 TTPs 3 IoCs

Windows Service

Disable or Modify System Firewall

T1562.004

pid	Process
5660	netsh.exe
3376	netsh.exe
5332	netsh.exe

Possible privilege escalation attempt 22 IoCs

exploit

pid	Process
4796	icacls.exe
4528	icacls.exe
1040	icacls.exe
3036	icacls.exe
1616	icacls.exe
4872	icacls.exe
1204	icacls.exe
5980	takeown.exe
4776	icacls.exe
5128	takeown.exe
4724	icacls.exe
4128	icacls.exe
1584	takeown.exe
1300	icacls.exe
996	takeown.exe
6008	icacls.exe
2092	takeown.exe
2964	icacls.exe
2236	icacls.exe
2980	icacls.exe
2436	icacls.exe
3512	takeown.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes a file named after a Windows system binary 1 TTPs 2 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\RuntimeBroker.exe	M1004NUS.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\RuntimeBroker.exe	RuntimeBroker.exe

Executes dropped EXE 6 IoCs

pid	Process
5268	Process not Found
4656	BootExecutor.exe
4224	M1004NUS.exe
1628	RuntimeBroker.exe
5152	ShellExperienceHost.exe
3448	CompPkgSrv.exe

Loads dropped DLL 2 IoCs

pid	Process
5268	Process not Found
5268	Process not Found

Modifies file permissions 1 TTPs 22 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2092	takeown.exe
1204	icacls.exe
4776	icacls.exe
2436	icacls.exe
4128	icacls.exe
1584	takeown.exe
1616	icacls.exe
4872	icacls.exe
2964	icacls.exe
2236	icacls.exe
4796	icacls.exe
5128	takeown.exe
3512	takeown.exe
1300	icacls.exe
4528	icacls.exe
1040	icacls.exe
2980	icacls.exe
5980	takeown.exe
4724	icacls.exe
996	takeown.exe
3036	icacls.exe
6008	icacls.exe

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 2 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Environment\UserInitMprLogonScript = "C:\\Windows\\Speech_OneCore\\Engines\\TTS\\ru-RU\\WinSyncLogon.cmd"	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Environment\UserInitMprLogonScript = "C:\\Windows\\Speech_OneCore\\Engines\\TTS\\ru-RU\\WinSyncLogon.cmd"	M1004NUS.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Windows security modification 2 TTPs 1 IoCs

defense_evasion trojan

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	M1004NUS.exe

Checks whether UAC is enabled 1 TTPs 6 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	BootExecutor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	BootExecutor.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	M1004NUS.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	mountvol.exe
File opened (read-only)	\??\Q:	mountvol.exe
File opened (read-only)	\??\V:	mountvol.exe
File opened (read-only)	\??\G:	mountvol.exe
File opened (read-only)	\??\I:	mountvol.exe
File opened (read-only)	\??\O:	mountvol.exe
File opened (read-only)	\??\H:	mountvol.exe
File opened (read-only)	\??\K:	mountvol.exe
File opened (read-only)	\??\R:	mountvol.exe
File opened (read-only)	\??\N:	mountvol.exe
File opened (read-only)	\??\P:	mountvol.exe
File opened (read-only)	\??\V:	mountvol.exe
File opened (read-only)	\??\R:	mountvol.exe
File opened (read-only)	\??\S:	mountvol.exe
File opened (read-only)	\??\R:	mountvol.exe
File opened (read-only)	\??\Y:	mountvol.exe
File opened (read-only)	\??\G:	mountvol.exe
File opened (read-only)	\??\E:	mountvol.exe
File opened (read-only)	\??\S:	mountvol.exe
File opened (read-only)	\??\J:	mountvol.exe
File opened (read-only)	\??\Y:	mountvol.exe
File opened (read-only)	\??\G:	mountvol.exe
File opened (read-only)	\??\M:	mountvol.exe
File opened (read-only)	\??\M:	mountvol.exe
File opened (read-only)	\??\X:	mountvol.exe
File opened (read-only)	\??\H:	mountvol.exe
File opened (read-only)	\??\M:	mountvol.exe
File opened (read-only)	\??\T:	mountvol.exe
File opened (read-only)	\??\T:	mountvol.exe
File opened (read-only)	\??\F:	mountvol.exe
File opened (read-only)	\??\K:	mountvol.exe
File opened (read-only)	\??\T:	mountvol.exe
File opened (read-only)	\??\W:	mountvol.exe
File opened (read-only)	\??\F:	mountvol.exe
File opened (read-only)	\??\L:	mountvol.exe
File opened (read-only)	\??\Y:	mountvol.exe
File opened (read-only)	\??\E:	Process not Found
File opened (read-only)	\??\H:	mountvol.exe
File opened (read-only)	\??\I:	mountvol.exe
File opened (read-only)	\??\S:	mountvol.exe
File opened (read-only)	\??\K:	mountvol.exe
File opened (read-only)	\??\J:	mountvol.exe
File opened (read-only)	\??\N:	mountvol.exe
File opened (read-only)	\??\O:	mountvol.exe
File opened (read-only)	\??\Y:	mountvol.exe
File opened (read-only)	\??\N:	mountvol.exe
File opened (read-only)	\??\P:	mountvol.exe
File opened (read-only)	\??\U:	mountvol.exe
File opened (read-only)	\??\U:	mountvol.exe
File opened (read-only)	\??\F:	mountvol.exe
File opened (read-only)	\??\L:	mountvol.exe
File opened (read-only)	\??\V:	mountvol.exe
File opened (read-only)	\??\L:	mountvol.exe
File opened (read-only)	\??\M:	mountvol.exe
File opened (read-only)	\??\W:	mountvol.exe
File opened (read-only)	\??\X:	mountvol.exe
File opened (read-only)	\??\E:	mountvol.exe
File opened (read-only)	\??\O:	mountvol.exe
File opened (read-only)	\??\S:	mountvol.exe
File opened (read-only)	\??\W:	mountvol.exe
File opened (read-only)	\??\G:	mountvol.exe
File opened (read-only)	\??\X:	mountvol.exe
File opened (read-only)	\??\F:	mountvol.exe
File opened (read-only)	\??\H:	mountvol.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\BootFiles\BootExecutor.exe	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\WinSyncLogon.cmd	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
File opened for modification	C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\WinSyncLogon.cmd	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
File created	C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\WinSyncLogon.cmd	M1004NUS.exe
File created	C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe

Launches sc.exe 11 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5624	sc.exe
1660	sc.exe
3152	sc.exe
4544	sc.exe
3388	sc.exe
5112	sc.exe
3368	sc.exe
2800	sc.exe
4252	sc.exe
2160	sc.exe
5980	sc.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 3 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

persistence privilege_escalation

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PHYSICALDRIVE0	BootExecutor.exe
File opened (read-only)	\??\PHYSICALDRIVE0	M1004NUS.exe
File opened (read-only)	\??\PHYSICALDRIVE0	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 16 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3244	cmd.exe
2720	cmd.exe
4868	cmd.exe
1824	cmd.exe
4332	cmd.exe
3740	cmd.exe
1664	CMD.exe
4696	CMD.exe
5648	cmd.exe
2936	cmd.exe
2868	cmd.exe
2336	cmd.exe
3452	cmd.exe
4876	cmd.exe
2792	cmd.exe
5368	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 14 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ShellExperienceHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	BootExecutor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	CompPkgSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	CompPkgSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	BootExecutor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	M1004NUS.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	M1004NUS.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ShellExperienceHost.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\gogoduck	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	Process not Found

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 25 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
4284	schtasks.exe
5088	schtasks.exe
3784	schtasks.exe
3660	schtasks.exe
484	schtasks.exe
5728	schtasks.exe
6028	schtasks.exe
4688	schtasks.exe
4664	schtasks.exe
3504	schtasks.exe
2184	schtasks.exe
4136	schtasks.exe
2040	schtasks.exe
5376	schtasks.exe
1884	schtasks.exe
2004	schtasks.exe
1952	schtasks.exe
1188	schtasks.exe
5736	schtasks.exe
4812	schtasks.exe
2980	schtasks.exe
1060	schtasks.exe
4448	schtasks.exe
4732	schtasks.exe
3212	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2368	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
2368	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
2368	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
2368	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
2368	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
2368	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
2368	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
2368	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
2368	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
2368	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
2368	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
2368	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
2368	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
2368	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
2368	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
2368	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
2368	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
2368	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
2368	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
2368	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
2368	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
2368	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
2368	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
2368	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
2368	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
2368	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
2368	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
2368	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
2368	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
2368	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
2368	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
4656	BootExecutor.exe
4656	BootExecutor.exe
4656	BootExecutor.exe
4224	M1004NUS.exe
4224	M1004NUS.exe
4224	M1004NUS.exe
4656	BootExecutor.exe
4656	BootExecutor.exe
4656	BootExecutor.exe
4656	BootExecutor.exe
4656	BootExecutor.exe
4224	M1004NUS.exe
4224	M1004NUS.exe
4224	M1004NUS.exe
4224	M1004NUS.exe
4224	M1004NUS.exe
4656	BootExecutor.exe
4656	BootExecutor.exe
4656	BootExecutor.exe
4656	BootExecutor.exe
4224	M1004NUS.exe
4656	BootExecutor.exe
4656	BootExecutor.exe
4656	BootExecutor.exe
4656	BootExecutor.exe
4656	BootExecutor.exe
4656	BootExecutor.exe
4224	M1004NUS.exe
4224	M1004NUS.exe
4224	M1004NUS.exe
4224	M1004NUS.exe
4224	M1004NUS.exe
4224	M1004NUS.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5268	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2368	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Token: SeShutdownPrivilege	5268	Process not Found
Token: SeCreatePagefilePrivilege	5268	Process not Found
Token: SeDebugPrivilege	4832	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Token: SeShutdownPrivilege	5268	Process not Found
Token: SeCreatePagefilePrivilege	5268	Process not Found
Token: SeShutdownPrivilege	5268	Process not Found
Token: SeCreatePagefilePrivilege	5268	Process not Found
Token: SeShutdownPrivilege	5268	Process not Found
Token: SeCreatePagefilePrivilege	5268	Process not Found
Token: SeShutdownPrivilege	5268	Process not Found
Token: SeCreatePagefilePrivilege	5268	Process not Found
Token: SeDebugPrivilege	2368	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Token: SeTakeOwnershipPrivilege	2368	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Token: SeRestorePrivilege	2368	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Token: SeShutdownPrivilege	5268	Process not Found
Token: SeCreatePagefilePrivilege	5268	Process not Found
Token: SeShutdownPrivilege	5268	Process not Found
Token: SeCreatePagefilePrivilege	5268	Process not Found
Token: SeShutdownPrivilege	5268	Process not Found
Token: SeCreatePagefilePrivilege	5268	Process not Found
Token: SeDebugPrivilege	4656	BootExecutor.exe
Token: SeShutdownPrivilege	5268	Process not Found
Token: SeCreatePagefilePrivilege	5268	Process not Found
Token: SeShutdownPrivilege	5268	Process not Found
Token: SeCreatePagefilePrivilege	5268	Process not Found
Token: SeShutdownPrivilege	5268	Process not Found
Token: SeCreatePagefilePrivilege	5268	Process not Found
Token: SeShutdownPrivilege	5268	Process not Found
Token: SeCreatePagefilePrivilege	5268	Process not Found
Token: SeShutdownPrivilege	5268	Process not Found
Token: SeCreatePagefilePrivilege	5268	Process not Found
Token: SeShutdownPrivilege	5268	Process not Found
Token: SeCreatePagefilePrivilege	5268	Process not Found
Token: SeShutdownPrivilege	5268	Process not Found
Token: SeCreatePagefilePrivilege	5268	Process not Found
Token: SeShutdownPrivilege	5268	Process not Found
Token: SeCreatePagefilePrivilege	5268	Process not Found
Token: SeShutdownPrivilege	5268	Process not Found
Token: SeCreatePagefilePrivilege	5268	Process not Found
Token: SeShutdownPrivilege	5268	Process not Found
Token: SeCreatePagefilePrivilege	5268	Process not Found
Token: SeDebugPrivilege	4224	M1004NUS.exe
Token: SeShutdownPrivilege	5268	Process not Found
Token: SeCreatePagefilePrivilege	5268	Process not Found
Token: SeShutdownPrivilege	5268	Process not Found
Token: SeCreatePagefilePrivilege	5268	Process not Found
Token: SeDebugPrivilege	4224	M1004NUS.exe
Token: SeTakeOwnershipPrivilege	4224	M1004NUS.exe
Token: SeRestorePrivilege	4224	M1004NUS.exe
Token: SeShutdownPrivilege	5268	Process not Found
Token: SeCreatePagefilePrivilege	5268	Process not Found
Token: SeShutdownPrivilege	5268	Process not Found
Token: SeCreatePagefilePrivilege	5268	Process not Found
Token: SeDebugPrivilege	1628	RuntimeBroker.exe
Token: SeDebugPrivilege	5152	ShellExperienceHost.exe
Token: SeDebugPrivilege	3448	CompPkgSrv.exe
Token: SeShutdownPrivilege	5268	Process not Found
Token: SeCreatePagefilePrivilege	5268	Process not Found
Token: SeShutdownPrivilege	5268	Process not Found
Token: SeCreatePagefilePrivilege	5268	Process not Found
Token: SeShutdownPrivilege	5268	Process not Found
Token: SeCreatePagefilePrivilege	5268	Process not Found
Token: SeShutdownPrivilege	5268	Process not Found

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5268	Process not Found
5268	Process not Found

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
5268	Process not Found
5268	Process not Found
5268	Process not Found
5268	Process not Found
5268	Process not Found
5268	Process not Found
5268	Process not Found
5268	Process not Found
5268	Process not Found
5268	Process not Found
5268	Process not Found
5268	Process not Found
5268	Process not Found
5268	Process not Found
5268	Process not Found
5268	Process not Found
5268	Process not Found
5268	Process not Found
5268	Process not Found
5268	Process not Found
5268	Process not Found
5268	Process not Found
5268	Process not Found
5268	Process not Found
5268	Process not Found
5268	Process not Found
5268	Process not Found
5268	Process not Found
5268	Process not Found
5268	Process not Found
5268	Process not Found
5268	Process not Found
5268	Process not Found
5268	Process not Found
5268	Process not Found
5268	Process not Found
5268	Process not Found
5268	Process not Found
5268	Process not Found
5268	Process not Found
5268	Process not Found
5268	Process not Found
5268	Process not Found
5268	Process not Found
5268	Process not Found
5268	Process not Found
5268	Process not Found
5268	Process not Found
5268	Process not Found
5268	Process not Found
5268	Process not Found
5268	Process not Found
5268	Process not Found
5268	Process not Found
5268	Process not Found
5268	Process not Found
5268	Process not Found
5268	Process not Found
5268	Process not Found
5268	Process not Found
5268	Process not Found
5268	Process not Found
5268	Process not Found
5268	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 3244	2368	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	90
PID 3244 wrote to memory of 5660	3244	cmd.exe	92
PID 2368 wrote to memory of 1208	2368	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	93
PID 2368 wrote to memory of 4544	2368	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	95
PID 2368 wrote to memory of 3388	2368	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	97
PID 2368 wrote to memory of 5112	2368	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	99
PID 2368 wrote to memory of 3608	2368	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	102
PID 2368 wrote to memory of 5336	2368	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	104
PID 2368 wrote to memory of 3840	2368	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	107
PID 2368 wrote to memory of 5152	2368	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	109
PID 2368 wrote to memory of 2828	2368	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	111
PID 2368 wrote to memory of 4284	2368	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	114
PID 2368 wrote to memory of 2720	2368	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	117
PID 2720 wrote to memory of 4812	2720	cmd.exe	119
PID 2368 wrote to memory of 4252	2368	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	120
PID 5268 wrote to memory of 5228	5268	Process not Found
PID 5268 wrote to memory of 5228	5268	Process not Found
PID 2368 wrote to memory of 3868	2368	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	123
PID 2368 wrote to memory of 4696	2368	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	124
PID 2368 wrote to memory of 4868	2368	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	125
PID 2368 wrote to memory of 3740	2368	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	126
PID 2368 wrote to memory of 4332	2368	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	127
PID 2368 wrote to memory of 2936	2368	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	131
PID 2368 wrote to memory of 3048	2368	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	132
PID 2368 wrote to memory of 5648	2368	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	133
PID 4868 wrote to memory of 6028	4868	cmd.exe	139
PID 2936 wrote to memory of 2040	2936	cmd.exe	140
PID 4696 wrote to memory of 1424	4696	CMD.exe	141
PID 2368 wrote to memory of 5088	2368	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	143
PID 4332 wrote to memory of 5376	4332	cmd.exe	145
PID 3740 wrote to memory of 1884	3740	cmd.exe	146
PID 5648 wrote to memory of 4688	5648	cmd.exe	147
PID 2368 wrote to memory of 4776	2368	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	148
PID 2368 wrote to memory of 1952	2368	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	199
PID 5268 wrote to memory of 2236	5268	Process not Found
PID 5268 wrote to memory of 2236	5268	Process not Found
PID 2368 wrote to memory of 4224	2368	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe	153
PID 4656 wrote to memory of 3452	4656	BootExecutor.exe	154
PID 4224 wrote to memory of 2868	4224	M1004NUS.exe	156
PID 4656 wrote to memory of 4452	4656	BootExecutor.exe	157
PID 4224 wrote to memory of 2964	4224	M1004NUS.exe	309
PID 3452 wrote to memory of 3376	3452	cmd.exe	161
PID 2868 wrote to memory of 5332	2868	cmd.exe	163
PID 4224 wrote to memory of 2160	4224	M1004NUS.exe	164
PID 4224 wrote to memory of 5980	4224	M1004NUS.exe	307
PID 4224 wrote to memory of 3368	4224	M1004NUS.exe	308
PID 4224 wrote to memory of 4496	4224	M1004NUS.exe	170
PID 4656 wrote to memory of 5624	4656	BootExecutor.exe	172
PID 4224 wrote to memory of 3784	4224	M1004NUS.exe	174
PID 4656 wrote to memory of 1660	4656	BootExecutor.exe	176
PID 4656 wrote to memory of 3152	4656	BootExecutor.exe	178
PID 4656 wrote to memory of 5592	4656	BootExecutor.exe	180
PID 4224 wrote to memory of 2800	4224	M1004NUS.exe	182
PID 4656 wrote to memory of 2004	4656	BootExecutor.exe	184
PID 4224 wrote to memory of 1664	4224	M1004NUS.exe	183
PID 4224 wrote to memory of 4876	4224	M1004NUS.exe	186
PID 4224 wrote to memory of 2792	4224	M1004NUS.exe	187
PID 4224 wrote to memory of 5368	4224	M1004NUS.exe	188
PID 4224 wrote to memory of 1824	4224	M1004NUS.exe	189
PID 4224 wrote to memory of 2336	4224	M1004NUS.exe	190
PID 1664 wrote to memory of 4284	1664	CMD.exe	198
PID 4876 wrote to memory of 1952	4876	cmd.exe	199
PID 5368 wrote to memory of 2980	5368	cmd.exe	281
PID 2336 wrote to memory of 4732	2336	cmd.exe	201

System policy modification 1 TTPs 18 IoCs

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	BootExecutor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	BootExecutor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "1"	BootExecutor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	BootExecutor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	BootExecutor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	BootExecutor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "1"	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	M1004NUS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "1"	M1004NUS.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Registers new Windows logon scripts automatically executed at logon.
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2368
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe" enable=yes & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3244
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:5660
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" E: /S
  2⤵
  PID:1208
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" delete "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:4544
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:3388
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" start "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:5112
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" E: /D
  2⤵
  PID:3608
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" F: /S
  2⤵
  PID:5336
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" F: /D
  2⤵
  PID:3840
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" G: /S
  2⤵
  PID:5152
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "UsbCeip_64934267" /F
  2⤵
  PID:2828
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "UsbCeip_64934267" /XML "C:\Users\Admin\AppData\Local\Temp\ce4578b6-850d-4460-b960-ced66d86aa11.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4284
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 12 /tn "MicrosoftEdgeUpdate" /tr "C:\Windows\System32\BootFiles\BootExecutor.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2720
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 12 /tn "MicrosoftEdgeUpdate" /tr "C:\Windows\System32\BootFiles\BootExecutor.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4812
- C:\Windows\SYSTEM32\sc.exe
  "sc" start TrustedInstaller
  2⤵
  - Launches sc.exe
  PID:4252
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" netsh advfirewall firewall add rule name="WindowsControl" dir=in action=allow program="C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" enable=yes & exit
  2⤵
  PID:3868
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c schtasks /delete /F /TN "Holy Check" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4696
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /F /TN "Holy Check"
    3⤵
    PID:1424
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc onlogon /tn "Holy Check" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4868
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /tn "Holy Check" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6028
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c schtasks /create /f /tn "Holy Check_OnLock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3740
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /tn "Holy Check_OnLock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1884
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c schtasks /create /f /tn "Holy Check_OnUnlock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4332
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /tn "Holy Check_OnUnlock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5376
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c schtasks /create /f /tn "Holy Check_OnIdle" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2936
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /tn "Holy Check_OnIdle" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2040
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "Microsoft Compatibility Appraiser_073042b2" /F
  2⤵
  PID:3048
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c schtasks /create /f /tn "Holy Check_Evt4624" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5648
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /tn "Holy Check_Evt4624" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4688
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "Microsoft Compatibility Appraiser_073042b2" /XML "C:\Users\Admin\AppData\Local\Temp\51db5b59-e52f-4407-a2ee-6ca270f86374.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5088
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" G: /D
  2⤵
  PID:4776
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" H: /S
  2⤵
  PID:1952
- C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe
  "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe"
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  - Modifies Windows Defender TamperProtection settings
  - UAC bypass
  - Drops file in Drivers directory
  - Executes a file named after a Windows system binary
  - Executes dropped EXE
  - Registers new Windows logon scripts automatically executed at logon.
  - Windows security modification
  - Checks whether UAC is enabled
  - Drops file in Windows directory
  - Direct Volume Access: Opens a physical disk for reading
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4224
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" enable=yes & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2868
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:5332
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" E: /S
    3⤵
    PID:2964
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete "WindowsUpdaterDefenderMicrosoft"
    3⤵
    - Launches sc.exe
    PID:2160
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"
    3⤵
    - Launches sc.exe
    PID:5980
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" start "WindowsUpdaterDefenderMicrosoft"
    3⤵
    - Launches sc.exe
    PID:3368
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_326d9e88" /F
    3⤵
    PID:4496
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Create /TN "NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_326d9e88" /XML "C:\Users\Admin\AppData\Local\Temp\a973e86b-5912-4fa2-aad3-304d7d3272c6.xml" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3784
- - C:\Windows\SYSTEM32\sc.exe
    "sc" start TrustedInstaller
    3⤵
    - Launches sc.exe
    PID:2800
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c schtasks /delete /F /TN "Holy Check" & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1664
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /F /TN "Holy Check"
      4⤵
      PID:4284
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc onlogon /tn "Holy Check" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4876
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc onlogon /tn "Holy Check" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1952
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c schtasks /create /f /tn "Holy Check_OnLock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
    3⤵
    - Executes a command shell one-liner
    PID:2792
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /tn "Holy Check_OnLock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3660
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c schtasks /create /f /tn "Holy Check_OnUnlock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5368
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /tn "Holy Check_OnUnlock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2980
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c schtasks /create /f /tn "Holy Check_OnIdle" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
    3⤵
    - Executes a command shell one-liner
    PID:1824
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /tn "Holy Check_OnIdle" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3212
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c schtasks /create /f /tn "Holy Check_Evt4624" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance" & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2336
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /tn "Holy Check_Evt4624" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4732
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "FamilySafetyRefreshTask_914f0607" /F
    3⤵
    PID:4464
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Create /TN "FamilySafetyRefreshTask_914f0607" /XML "C:\Users\Admin\AppData\Local\Temp\dafb0cc6-8252-4d42-875f-6075ab470e26.xml" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1060
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" E: /D
    3⤵
    PID:4936
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" F: /S
    3⤵
    PID:620
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "User_Feed_Synchronization-50586894-1675-4b46-8160-2988529b440c" /F
    3⤵
    PID:4236
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Create /TN "User_Feed_Synchronization-50586894-1675-4b46-8160-2988529b440c" /XML "C:\Users\Admin\AppData\Local\Temp\0efec87e-d22f-4163-82ed-fab82c64f0fb.xml" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5728
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "MicrosoftEdgeUpdateTaskMachineCore_2c942809" /F
    3⤵
    PID:3872
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Create /TN "MicrosoftEdgeUpdateTaskMachineCore_2c942809" /XML "C:\Users\Admin\AppData\Local\Temp\0e30e39d-ce5a-45b7-af4d-60dba0132e86.xml" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3504
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" F: /D
    3⤵
    - Enumerates connected drives
    PID:4968
- - C:\Windows\SYSTEM32\net.exe
    "net" stop WinDefend
    3⤵
    PID:5676
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop WinDefend
      4⤵
      PID:2836
- - C:\Windows\SYSTEM32\net.exe
    "net" start WinDefend
    3⤵
    PID:3960
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 start WinDefend
      4⤵
      PID:6140
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" G: /S
    3⤵
    PID:3576
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_2fa74370" /F
    3⤵
    PID:4596
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Create /TN "NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_2fa74370" /XML "C:\Users\Admin\AppData\Local\Temp\6f2c2912-ec58-45a5-8551-b22d6da4e113.xml" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2184
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Delete /TN "Consolidator_880a3abb" /F
    3⤵
    PID:2704
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Create /TN "Consolidator_880a3abb" /XML "C:\Users\Admin\AppData\Local\Temp\32d170f5-3937-4e7c-9d49-0c77696d5898.xml" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5736
- - C:\Windows\SYSTEM32\bcdedit.exe
    "bcdedit" /set testsigning on
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5324
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" G: /D
    3⤵
    - Enumerates connected drives
    PID:4232
- - C:\Windows\SYSTEM32\bcdedit.exe
    "bcdedit" /set nointegritychecks on
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:600
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" H: /S
    3⤵
    PID:3660
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Windows\system32\drivers\null.sys" /grant administrators:F /t /c
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2980
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Windows\system32\drivers\null.sys" /a
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5128
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Windows\system32\drivers\null.sys" /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4724
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Windows\system32\drivers\beep.sys" /grant administrators:F /t /c
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2436
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Windows\system32\drivers\beep.sys" /a
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:996
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Windows\system32\drivers\beep.sys" /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3036
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Windows\system32\drivers\rasl2tp.sys" /grant administrators:F /t /c
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4128
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Windows\system32\drivers\rasl2tp.sys" /a
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1584
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Windows\system32\drivers\rasl2tp.sys" /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:6008
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Windows\system32\drivers\raspppoe.sys" /grant administrators:F /t /c
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1616
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Windows\system32\drivers\raspppoe.sys" /a
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2092
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Windows\system32\drivers\raspppoe.sys" /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4872
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Windows\system32\drivers\raspptp.sys" /grant administrators:F /t /c
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1204
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4136
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Windows\system32\drivers\raspptp.sys" /a
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5980
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3368
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Windows\system32\drivers\raspptp.sys" /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2964
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3504
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Windows\system32\drivers\modem.sys" /grant administrators:F /t /c
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2236
- - C:\Windows\SYSTEM32\takeown.exe
    "takeown" /f "C:\Windows\system32\drivers\modem.sys" /a
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3512
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Windows\system32\drivers\modem.sys" /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4776
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Windows\system32\drivers\parport.sys" /grant administrators:F /t /c
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4796
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Windows\system32\drivers\serenum.sys" /grant administrators:F /t /c
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1300
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Windows\system32\drivers\serial.sys" /grant administrators:F /t /c
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4528
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2836
- - C:\Windows\SYSTEM32\icacls.exe
    "icacls" "C:\Windows\system32\drivers\usbprint.sys" /grant administrators:F /t /c
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1040
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" H: /D
    3⤵
    - Enumerates connected drives
    PID:5300
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" I: /S
    3⤵
    PID:5868
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" I: /D
    3⤵
    PID:4396
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" J: /S
    3⤵
    PID:3096
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" J: /D
    3⤵
    - Enumerates connected drives
    PID:1884
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" K: /S
    3⤵
    PID:2016
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" K: /D
    3⤵
    - Enumerates connected drives
    PID:1060
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" L: /S
    3⤵
    PID:5088
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" L: /D
    3⤵
    PID:3472
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" M: /S
    3⤵
    PID:5100
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" M: /D
    3⤵
    - Enumerates connected drives
    PID:3548
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" N: /S
    3⤵
    PID:2788
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" N: /D
    3⤵
    - Enumerates connected drives
    PID:2500
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" O: /S
    3⤵
    PID:2836
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" O: /D
    3⤵
    - Enumerates connected drives
    PID:4804
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" P: /S
    3⤵
    PID:5760
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" P: /D
    3⤵
    PID:2968
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" Q: /S
    3⤵
    PID:3220
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" Q: /D
    3⤵
    PID:1812
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" R: /S
    3⤵
    PID:3512
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" R: /D
    3⤵
    - Enumerates connected drives
    PID:2004
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" S: /S
    3⤵
    PID:4448
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" S: /D
    3⤵
    - Enumerates connected drives
    PID:2716
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" T: /S
    3⤵
    PID:5264
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" T: /D
    3⤵
    - Enumerates connected drives
    PID:3332
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" U: /S
    3⤵
    PID:2956
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" U: /D
    3⤵
    PID:3168
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" V: /S
    3⤵
    PID:3876
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" V: /D
    3⤵
    - Enumerates connected drives
    PID:1404
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" W: /S
    3⤵
    PID:3928
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" W: /D
    3⤵
    PID:3948
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" X: /S
    3⤵
    PID:4704
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" X: /D
    3⤵
    - Enumerates connected drives
    PID:692
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" Y: /S
    3⤵
    PID:1468
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" Y: /D
    3⤵
    - Enumerates connected drives
    PID:4796
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" E: /S
    3⤵
    PID:1360
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" E: /D
    3⤵
    - Enumerates connected drives
    PID:1952
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" F: /S
    3⤵
    PID:2704
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" F: /D
    3⤵
    - Enumerates connected drives
    PID:5320
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" G: /S
    3⤵
    PID:2716
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" G: /D
    3⤵
    - Enumerates connected drives
    PID:2196
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" H: /S
    3⤵
    PID:5632
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" H: /D
    3⤵
    - Enumerates connected drives
    PID:5840
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" I: /S
    3⤵
    PID:3364
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" I: /D
    3⤵
    - Enumerates connected drives
    PID:916
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" J: /S
    3⤵
    PID:1804
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" J: /D
    3⤵
    PID:1880
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" K: /S
    3⤵
    PID:2508
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" K: /D
    3⤵
    PID:2312
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" L: /S
    3⤵
    PID:3180
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" L: /D
    3⤵
    - Enumerates connected drives
    PID:5124
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" M: /S
    3⤵
    PID:4724
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" M: /D
    3⤵
    - Enumerates connected drives
    PID:5836
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" N: /S
    3⤵
    PID:2396
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" N: /D
    3⤵
    - Enumerates connected drives
    PID:620
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" O: /S
    3⤵
    PID:1568
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" O: /D
    3⤵
    PID:1328
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" P: /S
    3⤵
    PID:3212
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" P: /D
    3⤵
    - Enumerates connected drives
    PID:6016
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" Q: /S
    3⤵
    PID:4548
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" Q: /D
    3⤵
    - Enumerates connected drives
    PID:5460
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" R: /S
    3⤵
    PID:756
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" R: /D
    3⤵
    PID:5696
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" S: /S
    3⤵
    PID:4464
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" S: /D
    3⤵
    - Enumerates connected drives
    PID:1036
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" T: /S
    3⤵
    PID:4772
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" T: /D
    3⤵
    - Enumerates connected drives
    PID:2704
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" U: /S
    3⤵
    PID:2312
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" U: /D
    3⤵
    - Enumerates connected drives
    PID:200
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" V: /S
    3⤵
    PID:5736
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" V: /D
    3⤵
    PID:3576
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" W: /S
    3⤵
    PID:5316
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" W: /D
    3⤵
    - Enumerates connected drives
    PID:3400
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" X: /S
    3⤵
    PID:3608
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" X: /D
    3⤵
    - Enumerates connected drives
    PID:5660
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" Y: /S
    3⤵
    PID:4652
- - C:\Windows\SYSTEM32\mountvol.exe
    "mountvol" Y: /D
    3⤵
    - Enumerates connected drives
    PID:2832

C:\Users\Admin\AppData\Local\Temp\2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
C:\Users\Admin\AppData\Local\Temp\2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
1⤵
- Reads the TCP/IP host and domain name from the registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4832

C:\Windows\System32\BootFiles\BootExecutor.exe
C:\Windows\System32\BootFiles\BootExecutor.exe
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4656
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\System32\BootFiles\BootExecutor.exe" enable=yes & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3452
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\System32\BootFiles\BootExecutor.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:3376
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" E: /S
  2⤵
  PID:4452
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" delete "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:5624
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\System32\BootFiles\BootExecutor.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:1660
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" start "WindowsUpdaterDefenderMicrosoft"
  2⤵
  - Launches sc.exe
  PID:3152
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "Consolidator_793c7f66" /F
  2⤵
  PID:5592
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "Consolidator_793c7f66" /XML "C:\Users\Admin\AppData\Local\Temp\c4f00d9a-3116-4862-9dff-2da00e903962.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2004
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" E: /D
  2⤵
  - Enumerates connected drives
  PID:2528
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" F: /S
  2⤵
  PID:3696
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "MicrosoftEdgeUpdateTaskMachineCore_7c643b4d" /F
  2⤵
  PID:2744
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "MicrosoftEdgeUpdateTaskMachineCore_7c643b4d" /XML "C:\Users\Admin\AppData\Local\Temp\d607ffb0-295e-4f1e-b65c-6170b2e8e50b.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:484
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_993f1eca" /F
  2⤵
  PID:2360
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_993f1eca" /XML "C:\Users\Admin\AppData\Local\Temp\ebb608d0-6060-44da-b0fe-0379149866be.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4664
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_f84b766f" /F
  2⤵
  PID:2468
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" F: /D
  2⤵
  - Enumerates connected drives
  PID:3164
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_f84b766f" /XML "C:\Users\Admin\AppData\Local\Temp\8f7e1385-6afc-43d1-b88e-cf4d0d115a07.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1188
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" G: /S
  2⤵
  PID:4652
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "OneDrive Standalone Update Task_fc45cef1" /F
  2⤵
  PID:2016
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "OneDrive Standalone Update Task_fc45cef1" /XML "C:\Users\Admin\AppData\Local\Temp\772927f1-c7f5-4e78-bfda-9a354e2334ed.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4136
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Delete /TN "Microsoft Compatibility Appraiser_a18f737c" /F
  2⤵
  PID:1204
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /TN "Microsoft Compatibility Appraiser_a18f737c" /XML "C:\Users\Admin\AppData\Local\Temp\b28b5bed-a9ff-4490-8d6c-a461c765aa52.xml" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4448
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" G: /D
  2⤵
  - Enumerates connected drives
  PID:4424
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" H: /S
  2⤵
  PID:992
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" H: /D
  2⤵
  - Enumerates connected drives
  PID:5132
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" I: /S
  2⤵
  PID:5492
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" I: /D
  2⤵
  - Enumerates connected drives
  PID:5372
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" J: /S
  2⤵
  PID:4384
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" J: /D
  2⤵
  PID:4548
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3696
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" K: /S
  2⤵
  PID:484
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4652
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" K: /D
  2⤵
  - Enumerates connected drives
  PID:3368
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" L: /S
  2⤵
  PID:4688
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" L: /D
  2⤵
  - Enumerates connected drives
  PID:2668
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" M: /S
  2⤵
  PID:4484
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" M: /D
  2⤵
  - Enumerates connected drives
  PID:2032
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" N: /S
  2⤵
  PID:3064
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" N: /D
  2⤵
  PID:5948
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" O: /S
  2⤵
  PID:2916
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" O: /D
  2⤵
  - Enumerates connected drives
  PID:3920
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" P: /S
  2⤵
  PID:6108
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" P: /D
  2⤵
  PID:2112
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" Q: /S
  2⤵
  PID:1472
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" Q: /D
  2⤵
  PID:4084
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" R: /S
  2⤵
  PID:996
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" R: /D
  2⤵
  - Enumerates connected drives
  PID:4148
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" S: /S
  2⤵
  PID:4136
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" S: /D
  2⤵
  - Enumerates connected drives
  PID:464
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" T: /S
  2⤵
  PID:4464
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" T: /D
  2⤵
  PID:5224
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" U: /S
  2⤵
  PID:1880
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" U: /D
  2⤵
  PID:4720
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" V: /S
  2⤵
  PID:5212
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" V: /D
  2⤵
  - Enumerates connected drives
  PID:5696
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" W: /S
  2⤵
  PID:2352
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" W: /D
  2⤵
  - Enumerates connected drives
  PID:1052
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" X: /S
  2⤵
  PID:2988
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" X: /D
  2⤵
  - Enumerates connected drives
  PID:1540
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" Y: /S
  2⤵
  PID:2464
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" Y: /D
  2⤵
  - Enumerates connected drives
  PID:5324
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" E: /S
  2⤵
  PID:4664
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" E: /D
  2⤵
  - Enumerates connected drives
  PID:4652
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" F: /S
  2⤵
  PID:4188
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" F: /D
  2⤵
  - Enumerates connected drives
  PID:6016
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" G: /S
  2⤵
  PID:4448
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" G: /D
  2⤵
  - Enumerates connected drives
  PID:5688
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" H: /S
  2⤵
  PID:3328
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" H: /D
  2⤵
  - Enumerates connected drives
  PID:2816
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" I: /S
  2⤵
  PID:4240
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" I: /D
  2⤵
  PID:1544
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" J: /S
  2⤵
  PID:3400
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" J: /D
  2⤵
  - Enumerates connected drives
  PID:6108
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" K: /S
  2⤵
  PID:5640
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" K: /D
  2⤵
  - Enumerates connected drives
  PID:5064
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" L: /S
  2⤵
  PID:940
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" L: /D
  2⤵
  - Enumerates connected drives
  PID:1728
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" M: /S
  2⤵
  PID:1188
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" M: /D
  2⤵
  - Enumerates connected drives
  PID:1360
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" N: /S
  2⤵
  PID:2452
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" N: /D
  2⤵
  - Enumerates connected drives
  PID:4596
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" O: /S
  2⤵
  PID:3504
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" O: /D
  2⤵
  - Enumerates connected drives
  PID:4368
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" P: /S
  2⤵
  PID:5852
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" P: /D
  2⤵
  - Enumerates connected drives
  PID:2348
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" Q: /S
  2⤵
  PID:5824
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" Q: /D
  2⤵
  PID:4644
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" R: /S
  2⤵
  PID:4508
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" R: /D
  2⤵
  - Enumerates connected drives
  PID:3532
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" S: /S
  2⤵
  PID:2040
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" S: /D
  2⤵
  - Enumerates connected drives
  PID:4488
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" T: /S
  2⤵
  PID:708
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" T: /D
  2⤵
  - Enumerates connected drives
  PID:3796
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" U: /S
  2⤵
  PID:1204
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" U: /D
  2⤵
  - Enumerates connected drives
  PID:1660
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" V: /S
  2⤵
  PID:3876
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" V: /D
  2⤵
  - Enumerates connected drives
  PID:1476
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" W: /S
  2⤵
  PID:2156
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" W: /D
  2⤵
  - Enumerates connected drives
  PID:5640
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" X: /S
  2⤵
  PID:1528
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" X: /D
  2⤵
  PID:4884
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" Y: /S
  2⤵
  PID:5688
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" Y: /D
  2⤵
  - Enumerates connected drives
  PID:2032

C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\RuntimeBroker.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\RuntimeBroker.exe"
1⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:1628

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\ShellExperienceHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Templates\ShellExperienceHost.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:5152

C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache\CompPkgSrv.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache\CompPkgSrv.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:3448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Direct Volume Access

T1006

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Modify Registry