102356435909da9e369843738f59b9d481f90d1a0f2459a22c8d269ae8bc788e

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/07/2026, 18:24

Target
2026-07-17_bf30c51042b00e807e2b47384a54e992_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 6.7MB
Sample260717-w2bhbaev3s
SHA256 102356435909da9e369843738f59b9d481f90d1a0f2459a22c8d269ae8bc788e
MD5 bf30c51042b00e807e2b47384a54e992
SHA1 5b96b76558479f205334dac22338c4b6b4aa3150
SHA512 726884cd5bad126f1b2046a77fbcb9f6e356d95d8a4b844f4a4c19fd259a7937ff5fc9dd857ce1d6e6946b0948d904cf4c878141ccc818974530ecdda50ca008
SSDEEP 98304:ZAhyHutGRlnnOfFxrelnnOfFxrilnnOfFxrelnnOfFxr:ZAyutHr/r
TLSH
T16366CF387FE2D4D8EE272C7A6B89D45DD93BB558523D38BBBB810F4AC852A105B35070
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3192	2026-07-17_bf30c51042b00e807e2b47384a54e992_cobalt-strike_icedid_njrat_satacom_stealc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2968	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2968	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\2026-07-17_bf30c51042b00e807e2b47384a54e992_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_bf30c51042b00e807e2b47384a54e992_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:3192

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004EC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2968