6540f4397e59bb847b1ce87a6f67c58f952d2c49c5004021eeb9cd42f1ece8ee

Analysis

max time kernel
148s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/08/2026, 03:50

Target
2026-08-22_9e9cc433b0d0981431eb9865d7520488_cobalt-strike_glassworm_icedid_poet-rat_satacom_stealc_vidar.exe
Size 5.3MB
Sample260823-ed98asxtfs
SHA256 6540f4397e59bb847b1ce87a6f67c58f952d2c49c5004021eeb9cd42f1ece8ee
MD5 9e9cc433b0d0981431eb9865d7520488
SHA1 da0de36c21da6e131e5c214dbaf7cc1f13f4cb08
SHA512 988fee3d3dfc489cb4d6359ab9dd44893577c93597c6bad14e33a3559928284664f64af39d9813d033f36a02c54c5d48e00cd052bf77710e0e55ebe245ccd66b
SSDEEP 49152:oarqf59zPxKcvHzDB6t3+C0/aJfyLg7Ie4Xy+5j4m2CTHf4IDWbCJsk4VlPXA+1K:Bv2642o7lfthBIIBn
TLSH
T14F467D5672F080F5D26B8038A5976707FBB1744403244BDB53A089AA5FF3BE16EBE325
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3392	2026-08-22_9e9cc433b0d0981431eb9865d7520488_cobalt-strike_glassworm_icedid_poet-rat_satacom_stealc_vidar.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-22_9e9cc433b0d0981431eb9865d7520488_cobalt-strike_glassworm_icedid_poet-rat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-22_9e9cc433b0d0981431eb9865d7520488_cobalt-strike_glassworm_icedid_poet-rat_satacom_stealc_vidar.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3392