0cdbf296a3fea0082edd8923818de16727165efd3a19f310654d2b2e8230b7b0

Analysis

max time kernel
149s
max time network
92s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/05/2026, 22:31

Target
2026-05-02_18dd0faccd7192ad080aba7b76726af9_blankgrabber_cobalt-strike_glassworm_helldown_icedid_luc.exe
Size 12.4MB
Sample260502-2ftdwsct6j
SHA256 0cdbf296a3fea0082edd8923818de16727165efd3a19f310654d2b2e8230b7b0
MD5 18dd0faccd7192ad080aba7b76726af9
SHA1 e47484632393eb1585b2dbc416209c57e79fe274
SHA512 4627328c94068b832fafb27fd0f5cefed0c9f72ae32360f00dcf042721ee0891b253a73f44af8d3ed60ebf682daa993c63396a460bfe50ec1bfa44112bf3ade0
SSDEEP 98304:US8GOM8jlLiuCkZAy25mOhWi2PVLv0l7DkhtDE6akvnxrqN2D:UvljjlLicZx2UOhWi2PFv0BWowxrqN2
TLSH
T100D68E6AB6A440E4C1FEC179DA4B950BEBB27C95033193CF11E15A5A1F23AF49E7E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3948	2026-05-02_18dd0faccd7192ad080aba7b76726af9_blankgrabber_cobalt-strike_glassworm_helldown_icedid_luc.exe

C:\Users\Admin\AppData\Local\Temp\2026-05-02_18dd0faccd7192ad080aba7b76726af9_blankgrabber_cobalt-strike_glassworm_helldown_icedid_luc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-02_18dd0faccd7192ad080aba7b76726af9_blankgrabber_cobalt-strike_glassworm_helldown_icedid_luc.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3948