3b646ef062de1a27b8ab760cca7f2374211e39e46b26442e9def5d2fc4d1c03d

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 02:23

Target
2026-07-20_f37f155b3bbf8efa949f04bcb117a4dc_amadey_cobalt-strike_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc_vidar.exe
Size 15.0MB
Sample260720-cvasnacv5q
SHA256 3b646ef062de1a27b8ab760cca7f2374211e39e46b26442e9def5d2fc4d1c03d
MD5 f37f155b3bbf8efa949f04bcb117a4dc
SHA1 e281d60db742b0fdb8bcef9d21d19641016e4d6e
SHA512 53d9b7035f3fc35130695b244d0fe2c4043524f818cbf61efafc694d29764a528ef7f8a43af46564abb755753d1aab9be76dc562ab314f551fd87e10788c30eb
SSDEEP 393216:CgIwbtGe9qLlFSsNK9eX9Mmal2CFgzaGo1SoTkravKjda6y1tDX31YSp/1UvFAzY:aLfvKB2
TLSH
T15BF68B47B2670DD8D9678078C6F6A32BE1227C040B2157CB52A95F776F336E02B7AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	5812	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5812	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\2026-07-20_f37f155b3bbf8efa949f04bcb117a4dc_amadey_cobalt-strike_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_f37f155b3bbf8efa949f04bcb117a4dc_amadey_cobalt-strike_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc_vidar.exe"
1⤵
PID:5780

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004F0 0x00000000000004F8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5812

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:5396