0d56949b88fadba2304aa2afb2b99c586144f0894b61d252ca41f0d790ff2046

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/08/2026, 03:33

Target
2026-08-22_a222de956e06976424e01e9792098292_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
Size 3.1MB
Sample260823-d4l3qaxtcw
SHA256 0d56949b88fadba2304aa2afb2b99c586144f0894b61d252ca41f0d790ff2046
MD5 a222de956e06976424e01e9792098292
SHA1 de5bc816fba9642cc3c8552c221be09bba32fdb4
SHA512 4cae022c7dfd530a2acdae17bfacb7d1ca450ac8556ba6ade2cd345f3c8c85ae583e8d1d8531e72cf72e06c8231bc5094df582df63692079739075648bb98c43
SSDEEP 24576:xMxGeBR9bEz4H/6k6pjRvdHd8gmJWUzTtYyp:xMUyR9N6zjRvsgmzzTR
TLSH
T1B5E52ADEAA7511E1D5BEC33897C2712AF9713466733E57CB56508A0A0B62FE0AD3D380
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4220	2026-08-22_a222de956e06976424e01e9792098292_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-22_a222de956e06976424e01e9792098292_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-22_a222de956e06976424e01e9792098292_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4220