5900278c4faa9460a97c8bedf8da8a658660c266cd6b1b5a79d03064bd6f3c00

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/10/2026, 16:07

Target
2026-10-05_db1f3be2ccf54fc51528b947c5064e97_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 17.8MB
Sample261006-tkmsxaaw4w
SHA256 5900278c4faa9460a97c8bedf8da8a658660c266cd6b1b5a79d03064bd6f3c00
MD5 db1f3be2ccf54fc51528b947c5064e97
SHA1 6ad2a5cffba6480f9a2d2e94b93370179cf3c13e
SHA512 9d2e4c6547a15fe12f156bf740f98756102b3d0316df06370a2a74a8cbd8e0643d8ea7ad9dfb0b59ef1ee9b11365429857659252715277db1b728ae62715d792
SSDEEP 393216:O5Oq2v76Vmw7J6ivwYwIZSKly1pw6enx/hqWbdXQfM6R4RmhNHHsnvDwHCxt7C4:iOq2v76Vmw7J6iBwkNly7w66xvYMc3Nk
TLSH
T16117F0123382D812D4552CFB6D5DDAD9E371B9C19E0B63A332415B3F5EFE6928C29B80
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4872	2026-10-05_db1f3be2ccf54fc51528b947c5064e97_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3400	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3400	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\2026-10-05_db1f3be2ccf54fc51528b947c5064e97_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-05_db1f3be2ccf54fc51528b947c5064e97_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:4872

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004F0 0x00000000000004D0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3400