4176bd8c4e3c530a7540dcbe2727db62940ea6ccae39e35f8ee01005d62d5e40

Analysis

max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/08/2026, 23:28

Target
2026-08-21_d6a8aa56b60f5ed09e5e510188072686_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe
Size 8.1MB
Sample260821-3f2wpsdp4w
SHA256 4176bd8c4e3c530a7540dcbe2727db62940ea6ccae39e35f8ee01005d62d5e40
MD5 d6a8aa56b60f5ed09e5e510188072686
SHA1 463af6903e6fca96fbbf27ddb7d033870f3b7319
SHA512 a82814ff913805b545b0a334c5f1bac0c9e60fa67325e258bc57c5af3fd48ffcfd8daf13d3e6216ee24023920a9f59be00b0f9d381e728114f63263790503564
SSDEEP 98304:93vtYsVAGboEKRyWrwECO01VPWGWs3p+LLifZLo2assCCB:1vTVA2w5rw2oPWQ3I+fdoT8CB
TLSH
T11E868C43F854A5A4C5EAD230CA768292B670BC841B3077D33B11FBBA2A77BD46E75350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4632	2026-08-21_d6a8aa56b60f5ed09e5e510188072686_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-21_d6a8aa56b60f5ed09e5e510188072686_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-21_d6a8aa56b60f5ed09e5e510188072686_cobalt-strike_coinminer_dosia_frostygoop_ghostlocker_gla.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4632