87d068fe13b239f5f882220f3ccaf47a2869ad05c5111ff50d910bf9dd910636

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 22:48

Target
2026-08-04_74878ab52055ef660acdd2893294a19c_cobalt-strike_icedid_njrat_satacom_vidar.exe
Size 10.2MB
Sample260804-2q8xbsaa49
SHA256 87d068fe13b239f5f882220f3ccaf47a2869ad05c5111ff50d910bf9dd910636
MD5 74878ab52055ef660acdd2893294a19c
SHA1 505f959cb7bc9028ad1bbcd35203f223ee2f28bc
SHA512 b083e1851f15c7e659f1c6557a326ede5628846d3cf3ca9aba1f4bd49e15c96ea826cc47a7563d91588010391f97bda52e6b1781da575a339bcb9f78145f0d4a
SSDEEP 3072:MIE/0vwAG3O+VhadCl8Rawz9xgiGSeOab7Dpv/1DjX/w2:MIkAwDsUyfxiSeOQDbX3
TLSH
T1A0B6384BB7A534F5D5B681388891261AF77278B203208BDF1F60463A5F637E0AD3EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3884	2026-08-04_74878ab52055ef660acdd2893294a19c_cobalt-strike_icedid_njrat_satacom_vidar.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-04_74878ab52055ef660acdd2893294a19c_cobalt-strike_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_74878ab52055ef660acdd2893294a19c_cobalt-strike_icedid_njrat_satacom_vidar.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3884