a5e5cf6c08aa4a24ae5817c415cf4b35e54e30fb34858a966850062be878e072

Analysis

max time kernel
150s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 10:49

Target
2026-08-19_d7bcc2f7cd3193898804c0fbb25584aa_cobalt-strike_icedid_njrat_satacom.exe
Size 412KB
Sample260819-mwsd7stycv
SHA256 a5e5cf6c08aa4a24ae5817c415cf4b35e54e30fb34858a966850062be878e072
MD5 d7bcc2f7cd3193898804c0fbb25584aa
SHA1 ab1572189d12955437de14f083714f049cb3014d
SHA512 d3dca1d15a3016ee886c8ddfb7ffda89d8e60e4366097ade25aa4745c6600f0204c9b8f157fcabb63436e08d3d59f96c59728c4efb278a0ba26bec71d9b3a57f
SSDEEP 12288:UOoKe4XGDfkQ3mbTx6TyF461FmJHehPi:UOo2X4fkXTdr1SHB
TLSH
T117949E56E39925E9E863C13DC952C546EB72BC1A0320DBDF23A4A6183F337D19D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeSystemEnvironmentPrivilege	3348	2026-08-19_d7bcc2f7cd3193898804c0fbb25584aa_cobalt-strike_icedid_njrat_satacom.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-19_d7bcc2f7cd3193898804c0fbb25584aa_cobalt-strike_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_d7bcc2f7cd3193898804c0fbb25584aa_cobalt-strike_icedid_njrat_satacom.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3348