f55e9b34f5c9e48703ddb9a3c1cdd9656ae5d7597ee5dd0da02bee805334cb74

Analysis

max time kernel
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 13:25

Target
2026-08-14_7008ed64d89ae4ed43fd83ecf4446eb8_icedid_ryuk.exe
Size 312KB
Sample260814-qn89jacm21
SHA256 f55e9b34f5c9e48703ddb9a3c1cdd9656ae5d7597ee5dd0da02bee805334cb74
MD5 7008ed64d89ae4ed43fd83ecf4446eb8
SHA1 27822bbab3971a15c6be10bfebbe37a16ab1595e
SHA512 b3eb97f2dc7ca7cd16ec096a80369e526e5b6a227a0530e36d3ea1686e89d9420bf7a977c76f538c3450a332952a7410c9724884272d322755a14808e629733b
SSDEEP 6144:g/xeaxzDn3Qgo0JT+hiDzlOi9E3AAqgm:qxeaFVo0YhwzlOi9E3AAqz
TLSH
T1F364A3067141EA99C8614130CC2EDAF57B227CE4C6A14AF73AF27F7F3D752426D9A620
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1260	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1260	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5100	2026-08-14_7008ed64d89ae4ed43fd83ecf4446eb8_icedid_ryuk.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-14_7008ed64d89ae4ed43fd83ecf4446eb8_icedid_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_7008ed64d89ae4ed43fd83ecf4446eb8_icedid_ryuk.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:5100

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004FC 0x00000000000004F4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1260