1d9bfc18c740fc94e9ecb80a8ae437e481d98b1cb1874a22bab5b7defe325ca9

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 00:08

Target
2026-09-29_5d8043518a348abe9ea31a342f0a1a4b_cobalt-strike_icedid_njrat.exe
Size 406KB
Sample260930-aewn3saa93
SHA256 1d9bfc18c740fc94e9ecb80a8ae437e481d98b1cb1874a22bab5b7defe325ca9
MD5 5d8043518a348abe9ea31a342f0a1a4b
SHA1 7af249fc4e2a13a0a57f9d03195aa7047059c2b0
SHA512 9dabd2119a4fdaa7768bb5381d2b2078b786d1f74a2508f5534fad51e2b3d98f556521c2e4d660ce26e0819bf3464984a1ab3835e6b04990c9c526dbd5df166b
SSDEEP 6144:LlZB9MlDtSVELY+4UyuTS8pQmio5eO+XBRFqCBpvz4BM+vZWsFo5:LlZByoaLY+8xT3o5sPbQM+BRFQ
TLSH
T1A794AE16E3A524E9E8A7C13DC912C552E7B2BC560720DB9F12A476683F333D19D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeSystemEnvironmentPrivilege	1404	2026-09-29_5d8043518a348abe9ea31a342f0a1a4b_cobalt-strike_icedid_njrat.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-29_5d8043518a348abe9ea31a342f0a1a4b_cobalt-strike_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_5d8043518a348abe9ea31a342f0a1a4b_cobalt-strike_icedid_njrat.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1404