57d8b2e8d9772457f68cc59c873380148c1eb033c9764456411f447402389fd1

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/10/2026, 21:53

Target
2026-10-28_a4fff887967168ab176b72cd7d09feae_akira_cobalt-strike_satacom.exe
Size 200KB
Sample261029-1rt9wsfs3s
SHA256 57d8b2e8d9772457f68cc59c873380148c1eb033c9764456411f447402389fd1
MD5 a4fff887967168ab176b72cd7d09feae
SHA1 26a3615e4bfd60afc6719c57210947c429cf85b7
SHA512 2ce1370470cdf2fd098af5b2178936065eadca2ff519581ea39a0d314b0afed1c96dfffe35b52918adbc3a56c57ce9b5222f5adbd1e3814530c6fe3ba723bbae
SSDEEP 3072:M+wFlnUAnSWBGa027G0hW67N5IBuSdk4UaJ/KgvrEsA7VOaTR/2:MdFlDSmm2q0jN5IBuSdk5aNEZ7sa9/2
TLSH
T1E1143926B25624FCC42BC070825A4962B9727CC90B35BDFF278472396E76BE46F3C654
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	5840	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5840	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\2026-10-28_a4fff887967168ab176b72cd7d09feae_akira_cobalt-strike_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-28_a4fff887967168ab176b72cd7d09feae_akira_cobalt-strike_satacom.exe"
1⤵
PID:5648

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D8 0x00000000000004F0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5840

memory/5840-0-0x0000016741D70000-0x0000016741F5B000-memory.dmp

Download