75c81f624b2cd5871e930aaaa70f8f83dcf2d5605c4b55d18b930183a4f26edd

Analysis

max time kernel
2s
max time network
4s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/07/2026, 11:03

Reason

Machine shutdown

Target
2026-07-23_5c7afbeed5febcbee6ce28bfeff82bad_cobalt-strike_icedid.exe
Size 176KB
Sample260723-m5qlzacb48
SHA256 75c81f624b2cd5871e930aaaa70f8f83dcf2d5605c4b55d18b930183a4f26edd
MD5 5c7afbeed5febcbee6ce28bfeff82bad
SHA1 278cbacefd821a9cc1f825e12311e7122deb0966
SHA512 bb27442ec7b1a3e91971394ec7e73823faf55e9caa597c66eb47cc9d1ced77b564101feea213096b85ad1d2418c57d1dbd0dc8d28421442050e6f909d4197f1c
SSDEEP 3072:Evx15qG6yMOvdlAWukzy8yPCaH62DtSN0JwQe:E5TqGRLAW7aT62zwB
TLSH
T1A8046B43E6A632F6D2664D748461898A47327E3557609BBB1740238F2EB36D38C79F33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3036	2026-07-23_5c7afbeed5febcbee6ce28bfeff82bad_cobalt-strike_icedid.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2044	2026-07-23_5c7afbeed5febcbee6ce28bfeff82bad_cobalt-strike_icedid.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 2044	3036	2026-07-23_5c7afbeed5febcbee6ce28bfeff82bad_cobalt-strike_icedid.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-23_5c7afbeed5febcbee6ce28bfeff82bad_cobalt-strike_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_5c7afbeed5febcbee6ce28bfeff82bad_cobalt-strike_icedid.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Users\Admin\AppData\Local\Temp\2026-07-23_5c7afbeed5febcbee6ce28bfeff82bad_cobalt-strike_icedid.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-23_5c7afbeed5febcbee6ce28bfeff82bad_cobalt-strike_icedid.exe" /popup
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2044