c5018977d6135e416c0d8fce2971d466f67db6997c7945617688fe943bb57927

Analysis

max time kernel
2s
max time network
4s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 03:22

Reason

Machine shutdown

Target
2026-08-08_71f6ea348e70dfd5460e7fab6b81505d_cobalt-strike_icedid_satacom.exe
Size 383KB
Sample260808-dxdg1asthv
SHA256 c5018977d6135e416c0d8fce2971d466f67db6997c7945617688fe943bb57927
MD5 71f6ea348e70dfd5460e7fab6b81505d
SHA1 b569a28455ddb3290af57510e0763b75f84b5dd8
SHA512 746aad9cc919f8836682ee4c95e645b5ede9155733ddc58fcffc21e8a4856c871a752273259085e050454157fa628a55d4b9d80eb5d5db3139486efd0592342c
SSDEEP 6144:lTpyo2aesdYs12n0pIc4KuXY/rANWvHG9eMlySrTIuW0m:lTz2az5PeWvmz/I57
TLSH
T19884D057799428ECE432C434E461838297F2F53647A95FDF97E88B420E126E19E2DF38
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4272	2026-08-08_71f6ea348e70dfd5460e7fab6b81505d_cobalt-strike_icedid_satacom.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-08_71f6ea348e70dfd5460e7fab6b81505d_cobalt-strike_icedid_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_71f6ea348e70dfd5460e7fab6b81505d_cobalt-strike_icedid_satacom.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4272