18eab960e53c3abae8dab0efc833fca7ab568bbb2fd5bc94a515b8f867b3f599

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/07/2026, 21:34

Target
2026-07-17_ab80391e69db32cb3d606e856bfdf872_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_stealc.exe
Size 21.8MB
Sample260717-1e7pfsav7x
SHA256 18eab960e53c3abae8dab0efc833fca7ab568bbb2fd5bc94a515b8f867b3f599
MD5 ab80391e69db32cb3d606e856bfdf872
SHA1 787c141f0d22d892034b9901062c95366ec44cd8
SHA512 bb18f353f1ed8d592df227e391f6247d8b3e091ae0d8c967318b087dde59f45f05dc630f3f4f5d15f7ba8c916f27ab051847d0e6bba9143f17c4eb346a37fc6a
SSDEEP 196608:4GFrOBiyc7iEp2yRSAVjEiaqXFSHuEicF1x1K2hO9qEs7BOsfEMRF6+i8IhuWoZ8:nE91thPhREMRFTIhuWoK
TLSH
T197379F43A26634CAC0B6D67C0113A236F56AFC1DCB24C7F78AD3FD265AB27901E15B64
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3368	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3368	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4116	2026-07-17_ab80391e69db32cb3d606e856bfdf872_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_stealc.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-17_ab80391e69db32cb3d606e856bfdf872_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_ab80391e69db32cb3d606e856bfdf872_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_stealc.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4116

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004F0 0x00000000000004D0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3368