Analysis
- max time kernel
148s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/08/2026, 02:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-01_9ebe90bba3f6cba9cd6410be4ccdd54f_cobalt-strike_hijackloader_icedid_stealc.exe
Resource
win10v2004-20260513-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-01_9ebe90bba3f6cba9cd6410be4ccdd54f_cobalt-strike_hijackloader_icedid_stealc.exe
Resource
win11ltsc2024-20260709-en
1 signatures
150 seconds
General
- Target 2026-08-01_9ebe90bba3f6cba9cd6410be4ccdd54f_cobalt-strike_hijackloader_icedid_stealc.exe
- Size 302KB
- Sample260801-ddmlkawdpd
- SHA256 6914166477c5813f0ca0543bbaf401cfb6f3cd230bd8e111739f0860ee6e37ad
- MD5 9ebe90bba3f6cba9cd6410be4ccdd54f
- SHA1 f3d785a04d6783cc4b5a9e93bae188e4802f7157
- SHA512 2a4ff7db09109e37ae335e3e9c284f2b5c4febad8fbd2f68f7570bf1950863e2016ae8b4b309494a8b6cb578086a65419bce16fb6d023fb4e680990ef069553a
- SSDEEP 6144:vQcfcTiIxIFXMNNhQAyA7GbqWvCNW/Ytoa:vrsiuIFENh3nWvEWgV
- TLSH T135647D12B6A51CF9E977C538C9524506DBB2BC464760EACF03A04E9A9F337D06E3E712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 5856 2026-08-01_9ebe90bba3f6cba9cd6410be4ccdd54f_cobalt-strike_hijackloader_icedid_stealc.exe Token: SeLoadDriverPrivilege 5856 2026-08-01_9ebe90bba3f6cba9cd6410be4ccdd54f_cobalt-strike_hijackloader_icedid_stealc.exe Token: SeSystemEnvironmentPrivilege 5856 2026-08-01_9ebe90bba3f6cba9cd6410be4ccdd54f_cobalt-strike_hijackloader_icedid_stealc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-01_9ebe90bba3f6cba9cd6410be4ccdd54f_cobalt-strike_hijackloader_icedid_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-01_9ebe90bba3f6cba9cd6410be4ccdd54f_cobalt-strike_hijackloader_icedid_stealc.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5856