82f1ae3eb7962908a03a993a02ae794477cb59d6d1f348641edf8ef342ccec0a

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 14:35

Target
2026-08-04_acade77c20de5ad0bab890223656ce5e_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 1.9MB
Sample260804-ryggyaztcs
SHA256 82f1ae3eb7962908a03a993a02ae794477cb59d6d1f348641edf8ef342ccec0a
MD5 acade77c20de5ad0bab890223656ce5e
SHA1 9912796e0089630e2d41785fcbf26b07f99dc44a
SHA512 45d9d63dd559581169eb392985762e8dbffce2b889b864893bdd1a7881d0937354903a45fd08fd5f00fd0bac06fa15e443c49b57712c8158fa023f19d7da43bf
SSDEEP 49152:ZTnlqYrhX5Ken7NxQyFRwxCph0nK0ZYtTj6MPnh8i:ZlFpZnhxLyxWEy6MPn3
TLSH
T1E9958E56B39851E4F1F7C17DCAD7494BEBB27809032196DB06E0469A1F27EE80E7E324
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2548	2026-08-04_acade77c20de5ad0bab890223656ce5e_cobalt-strike_icedid_njrat_satacom_stealc.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-04_acade77c20de5ad0bab890223656ce5e_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_acade77c20de5ad0bab890223656ce5e_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2548