48f8343917b58272a21a9535f4f9ba651737252741090168aef04cedee4fd62c

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 04:31

Target
2026-07-11_6d03195acae765f5418e7cc7734243da_cobalt-strike_icedid.exe
Size 304KB
Sample260711-e5mw3sdy4s
SHA256 48f8343917b58272a21a9535f4f9ba651737252741090168aef04cedee4fd62c
MD5 6d03195acae765f5418e7cc7734243da
SHA1 990da5edd145fa80afd6cb49ec4fd7acbed16bb2
SHA512 65301a97b40910f977ced384a3819a9255d8cbfbb3fd3fb6f126007f70de3ebd39f023e9eb2038e5f792da1ce7e82037188e2054144206eafc99972bdf82ba93
SSDEEP 3072:NLyjI5IQZEzflQuboi1w2rxe7k52CojHP/2mUsGLxvjm93SwjKWj2To:NLy2Uci1U8lw95jlj2To
TLSH
T151642B062E603FA9F321B0BB87711137FAE26F21F2579A5A0D7075575A3F6A05CFA210
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion

Disables RegEdit via registry modification 1 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	2026-07-11_6d03195acae765f5418e7cc7734243da_cobalt-strike_icedid.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1268	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1268	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\2026-07-11_6d03195acae765f5418e7cc7734243da_cobalt-strike_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-11_6d03195acae765f5418e7cc7734243da_cobalt-strike_icedid.exe"
1⤵
- Disables RegEdit via registry modification
PID:1336

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004EC 0x00000000000004E0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1268