77adb3730064fd32e58eca66e17ebec6b273c1446bfd4fbc774e5baece71d244

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
06/06/2026, 21:58

Target
2026-06-06_193f74b6e8d0111af8dc9d30e3f0bb16_akira_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 912KB
Sample260606-1vl3padt5p
SHA256 77adb3730064fd32e58eca66e17ebec6b273c1446bfd4fbc774e5baece71d244
MD5 193f74b6e8d0111af8dc9d30e3f0bb16
SHA1 c5720cf3181e835e71f8780638c71ac59c738ec6
SHA512 26bc2a1576480f7350a62d179a6db34f9973fae88e377245321f48129ba0247eeb482d30b6c427b667ba69ae1c4c349ab88520fa2c190bd7f487378f47ebcb8c
SSDEEP 24576:yLKJn75xu0CdoUdooVbP9AGkStn2m9TbtEy:yAxutaoFPr
TLSH
T16F158E39F29C52EBD122E17888D6490AE771744643295BCBD3918AAF2F17AF05F3E350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4812	2026-06-06_193f74b6e8d0111af8dc9d30e3f0bb16_akira_cobalt-strike_icedid_njrat_satacom_stealc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4812 wrote to memory of 3664	4812	2026-06-06_193f74b6e8d0111af8dc9d30e3f0bb16_akira_cobalt-strike_icedid_njrat_satacom_stealc.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-06-06_193f74b6e8d0111af8dc9d30e3f0bb16_akira_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-06_193f74b6e8d0111af8dc9d30e3f0bb16_akira_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  PID:3664