ff0e7c7e428674a6d5b1c6632019dd6120172245e227c615c09af71b9ac394d9

Analysis

max time kernel
148s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 18:39

Target
2026-07-08_11043481a743a624a2e577a511ce3f38_cobalt-strike_icedid_njrat_satacom_vidar.exe
Size 10.2MB
Sample260708-xaqctsf151
SHA256 ff0e7c7e428674a6d5b1c6632019dd6120172245e227c615c09af71b9ac394d9
MD5 11043481a743a624a2e577a511ce3f38
SHA1 31013119fb5caec54f61ab873aa83cce2de512d7
SHA512 2059095b8f54659e0e404a1646ab2928414d09044e9df0843a3deb7daa4a7e864fcf5b2034b3c59ade0bec16b45f7f75380953ca01b46d7f74ada18332e33e32
SSDEEP 3072:M7E/0vwAG3O+VhadCl8Rawz9xgiGSeOab7Dpvx1DjX/wX:M7kAwDsUyfxiSeOQDZXE
TLSH
T16BB6387BB6A520F5D5B681388891261AF77378B203208BDF1760463A5F737E0AD3EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4696	2026-07-08_11043481a743a624a2e577a511ce3f38_cobalt-strike_icedid_njrat_satacom_vidar.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-08_11043481a743a624a2e577a511ce3f38_cobalt-strike_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_11043481a743a624a2e577a511ce3f38_cobalt-strike_icedid_njrat_satacom_vidar.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4696