84b7560cd71bdbea38d183f39f60affd57e07e1a465d2cdec1d889d0a51e9cff

Analysis

max time kernel
61s
max time network
21s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 11:55

Reason

Machine shutdown

Target
2026-07-18_0ea87f0358a74901c3e627e71dd4d886_cobalt-strike_icedid_satacom.exe
Size 118KB
Sample260718-n3p34ady2x
SHA256 84b7560cd71bdbea38d183f39f60affd57e07e1a465d2cdec1d889d0a51e9cff
MD5 0ea87f0358a74901c3e627e71dd4d886
SHA1 1d0fab50e49930c1ef0b94116a3cb084c9e5f04c
SHA512 c2bc835ba21b18f5c27bddfb13d469a330f17e9b8cee5064dd74caf1e6354b762f27bb69eade4d5cf81e70098790c87c1fdaafc9ea9ba1c4cf4f966d36325a43
SSDEEP 3072:o+Tc9fijcB+UMc20jjG6JT4Sxcsb8SkU1s6q:uqjc8OB/T4SxoW
TLSH
T111C36C5B77A630F8E1778279C4514A05E372B8720B61DFEF43A0465A2F232D49E3EB25
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: 33	2416	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2416	AUDIODG.EXE
Token: SeShutdownPrivilege	5876	2026-07-18_0ea87f0358a74901c3e627e71dd4d886_cobalt-strike_icedid_satacom.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-18_0ea87f0358a74901c3e627e71dd4d886_cobalt-strike_icedid_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_0ea87f0358a74901c3e627e71dd4d886_cobalt-strike_icedid_satacom.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5876

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004EC 0x00000000000004E8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2416