3d55fd3d0bcc078484472ad5d44beb885bc762bbe557a20ff8f5279ab911b719

Analysis

max time kernel
148s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/08/2026, 03:52

Target
2026-08-21_d5e7010229fc8bdb2f4f41a50b2ddadb_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 268KB
Sample260821-eff28sscld
SHA256 3d55fd3d0bcc078484472ad5d44beb885bc762bbe557a20ff8f5279ab911b719
MD5 d5e7010229fc8bdb2f4f41a50b2ddadb
SHA1 6d46843ffec11b8795a6b63f82e7a2a3f32f3c68
SHA512 db4b7d2150c0b8eb79ab77565215b0604bd6f6d969eea8decbf40cc869db0e828ef73a83e4a2209a4774c72e8deb60ecded0810b566b13329e6f9e40138259af
SSDEEP 3072:5KCCQ5/zNrYcs2il0gxa4LC/pB8tVIdQsfZGroHTXBKFi568T1El:5KMqj2s0yChB2VofZYI5tpEl
TLSH
T1EF445C15E7E508E5F9B3863D89B58512EB727C115B30DADF03A4826A2F33BD09D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
820	Process not Found

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	944	2026-08-21_d5e7010229fc8bdb2f4f41a50b2ddadb_cobalt-strike_icedid_njrat_satacom_stealc.exe
Token: SeProfSingleProcessPrivilege	944	2026-08-21_d5e7010229fc8bdb2f4f41a50b2ddadb_cobalt-strike_icedid_njrat_satacom_stealc.exe
Token: SeDebugPrivilege	944	2026-08-21_d5e7010229fc8bdb2f4f41a50b2ddadb_cobalt-strike_icedid_njrat_satacom_stealc.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-21_d5e7010229fc8bdb2f4f41a50b2ddadb_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-21_d5e7010229fc8bdb2f4f41a50b2ddadb_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:944