ac36dd812caa36a0d5084929a9bfbcd5905adc9743a29c835e79967d75f7ec14

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 17:14

Target
2026-09-25_f47fce9a6453cdda65ec6f60718bd068_cobalt-strike_icedid.exe
Size 131KB
Sample260925-vsdewas18m
SHA256 ac36dd812caa36a0d5084929a9bfbcd5905adc9743a29c835e79967d75f7ec14
MD5 f47fce9a6453cdda65ec6f60718bd068
SHA1 ee4cd17e2390dd4e279d63a0415a0c86cb7a05db
SHA512 635fc691c4751ea583ccbdbd9147388aef7b3f5bcbd94150cfc29874a5e2f04fa8479e91154312a5716c032f6b4e8876375b08826f28fafc5c7db579e8feb47a
SSDEEP 3072:REYvuYeweXlgl3ku3f+p9J6BFs0tDT+wOCwPnvUOaK2cH:221eO3ku3WbJr/nvpIcH
TLSH
T1C1D37D57B3E530F8E1778179C4A1170AEB72B8721BA09BDF07A046652F236D09E3DB25
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeAssignPrimaryTokenPrivilege	4052	2026-09-25_f47fce9a6453cdda65ec6f60718bd068_cobalt-strike_icedid.exe
Token: SeCreateGlobalPrivilege	4052	2026-09-25_f47fce9a6453cdda65ec6f60718bd068_cobalt-strike_icedid.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-25_f47fce9a6453cdda65ec6f60718bd068_cobalt-strike_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-25_f47fce9a6453cdda65ec6f60718bd068_cobalt-strike_icedid.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4052