5431f249953bb6b1b1024f1b26af2deeed56e996b301fde91ca12baf066248cb

Analysis

max time kernel
148s
max time network
117s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 23:13

Target
2026-08-09_135ba583617cdbbebef7640fb4213097_cobalt-strike_icedid_njrat_satacom.exe
Size 404KB
Sample260809-27cv8az1bw
SHA256 5431f249953bb6b1b1024f1b26af2deeed56e996b301fde91ca12baf066248cb
MD5 135ba583617cdbbebef7640fb4213097
SHA1 a672b44bc2621dac5983ae507d60f16d1b16c887
SHA512 bd4fbe43e8a29a7be05b17716e468812b97bd007768b0caec06f733bab6f5afe904f05176e634a5f2cdfc6b9e05f1ca7a241d52edb5b4138ff12a585045a6d84
SSDEEP 6144:KAsdjJ4/u4w/XFLjEzWHaZvCbfCvftCBR6qK5rFhs1aAvZWsFo5:KAI1f/XtwMWCbfCntuaABRFQ
TLSH
T1D3948D56E3D521E9E863C13CC952C646EBB2BC160321D6EF2364A6153F336D1AD3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeSystemEnvironmentPrivilege	908	2026-08-09_135ba583617cdbbebef7640fb4213097_cobalt-strike_icedid_njrat_satacom.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-09_135ba583617cdbbebef7640fb4213097_cobalt-strike_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_135ba583617cdbbebef7640fb4213097_cobalt-strike_icedid_njrat_satacom.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:908