3eb6f89b98041ad3a4ef50e99bf211432d38cf7f00432d52cc823657666220f8

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/09/2026, 03:51

Target
2026-09-27_8109319537e34b993b9a1ba08e073934_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 6.7MB
Sample260928-eeta6stw6j
SHA256 3eb6f89b98041ad3a4ef50e99bf211432d38cf7f00432d52cc823657666220f8
MD5 8109319537e34b993b9a1ba08e073934
SHA1 7a960762009dff1bda1aa6912e885c7c476e1868
SHA512 d940cc72fc949a2b2cd81f0eff7ea03c59564a132c4fd601a5ccab60f5402c4ea968b76ad40314fa45ccf4f233d82796f1cb5e65a5423016343789abbf6b2990
SSDEEP 196608:7CHvPbiqHiLuZ9Ms3rLojGtDNivUrNlSI:cziqCLebLoCgo
TLSH
T1F0660242F21253A0D5EE8536CE538A02D7327C5E9F025BAB6178EB113DE31836F2775A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4860	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4860	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\2026-09-27_8109319537e34b993b9a1ba08e073934_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-27_8109319537e34b993b9a1ba08e073934_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
PID:4228

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004FC 0x00000000000004F4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4860