dd0693541bac18111806af7886e1142b871d5bb5811693c6ed173916bcec5f09

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 12:08

Target
2026-08-10_6131b75916c1574f1e016822b3637c44_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
Size 14.0MB
Sample260810-pbaprss1b1
SHA256 dd0693541bac18111806af7886e1142b871d5bb5811693c6ed173916bcec5f09
MD5 6131b75916c1574f1e016822b3637c44
SHA1 f649598525fe0297fb47b1e605cedaf9f4ea035c
SHA512 895b92a186ad5ce932d253f0b2b38c02f962fa896c22df67c8634995dd0948ff8f5cdb9962689a3779da29a24b8a45a775aaeab9cdcdaf6da37c392270d5314a
SSDEEP 196608:EqyZOiySzHDUSAVW/Zn0UsDEnhjicCQceIxrPI4BB2UhBBBUBBBBBBBB4BBBBBBK:EdyS0HAR3YEhjicCQbmk
TLSH
T1CCE6E193B16704C8C2B6C03C8286D52BE77279594322CBEB159196B97F27EF14F7B260
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	5516	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5516	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5428	2026-08-10_6131b75916c1574f1e016822b3637c44_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
5428	2026-08-10_6131b75916c1574f1e016822b3637c44_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
5428	2026-08-10_6131b75916c1574f1e016822b3637c44_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-10_6131b75916c1574f1e016822b3637c44_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_6131b75916c1574f1e016822b3637c44_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:5428

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x32c 0x4fc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5516