9ff8ac21055c333d8b35b6e614512bdbaa3a49a53ada45ff2865dd27323e2378

Analysis

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
31/05/2026, 02:20

Target
2026-05-31_f70e3cf4d3ecf7f0611b6210185fbce1_cobalt-strike_icedid_njrat_satacom.exe
Size 159KB
Sample260531-csskpaax7k
SHA256 9ff8ac21055c333d8b35b6e614512bdbaa3a49a53ada45ff2865dd27323e2378
MD5 f70e3cf4d3ecf7f0611b6210185fbce1
SHA1 0f7b7b0fbbbc389cfd4104a6db488de128e936a7
SHA512 591b6389e74f093b53d6653f5ec827bb8557b5115a10691a9babb32d98fc254e8fbf2802baf260a04ac9715334e29b037ade62424d52585239316abcedda0c05
SSDEEP 3072:SJpqKuEi98j6kQA03vjh3bmX5rcyBoUe8fvwWC+wYhf:SO98j6kWvpbmpqFdHY
TLSH
T18DF35A4773A630F9E177923889614646F7B2B43217708BFF47A442B52F23AD09D3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2704	2026-05-31_f70e3cf4d3ecf7f0611b6210185fbce1_cobalt-strike_icedid_njrat_satacom.exe

C:\Users\Admin\AppData\Local\Temp\2026-05-31_f70e3cf4d3ecf7f0611b6210185fbce1_cobalt-strike_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-31_f70e3cf4d3ecf7f0611b6210185fbce1_cobalt-strike_icedid_njrat_satacom.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2704