52d26c3b018a97dec5954846ad181cf199176a01d9b0042c6ee139996df2959d

Analysis

max time kernel
148s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 17:24

Target
2026-08-10_598a0d6d8de3502cf757aab10593e13e_cobalt-strike_icedid_satacom.exe
Size 125KB
Sample260810-vypp4ayydy
SHA256 52d26c3b018a97dec5954846ad181cf199176a01d9b0042c6ee139996df2959d
MD5 598a0d6d8de3502cf757aab10593e13e
SHA1 cb36decb33b2ad2b328678f4503fa4657ab1845b
SHA512 09618cba5ce4d8c196cfa379c34f3bb5c9abfffeca0c78a31a08df7debe0f48f6d876414d565b7d48f7d2a9a3d86b4de9f4db39f0df740f5126916edb7f64d12
SSDEEP 3072:pu/xoVRzySJ+wE3qeu5bGzmYaNIDpgceO6njSyBK89fm9:8/SVRzySJ+w71umYZNeJ+
TLSH
T103C35B5773A530F8E5778679C0914A09E772B83507615FFF03A0426A6F237D09E3AB62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1544	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1544	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\2026-08-10_598a0d6d8de3502cf757aab10593e13e_cobalt-strike_icedid_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_598a0d6d8de3502cf757aab10593e13e_cobalt-strike_icedid_satacom.exe"
1⤵
PID:4304

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D0 0x00000000000004D8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1544