1523bb4cb50d3629cb42b9e78042f482637b049d5b3a740ad1adecd386bf7d61

Analysis

max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 11:37

Target
2026-11-07_a11a38b8593e36a27ea26c1a02ac82ed_cobalt-strike_icedid_satacom.exe
Size 520KB
Sample261107-nrgbtabt4x
SHA256 1523bb4cb50d3629cb42b9e78042f482637b049d5b3a740ad1adecd386bf7d61
MD5 a11a38b8593e36a27ea26c1a02ac82ed
SHA1 90b67bf08d270c060355d03fd6d4dfc0401cca6f
SHA512 d450928624cfef9eff5d05fcaefca30c7fde3ae8e5952b07fccb3265957e1680b6d6333bde3cb1310064a57d1367fc810b44170d69db70866120152f981340ce
SSDEEP 12288:wZuSZx0R6PokY62zsIsHz+o2yUdw6c7Qylp7jMAIIpaqj:wZun9sX+uUdw4yldGA/
TLSH
T12FB4025763F534ECC077813984961A05F776B8354B209EFB0360D6B82E2B7E59E3BA60
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3716	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3716	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\2026-11-07_a11a38b8593e36a27ea26c1a02ac82ed_cobalt-strike_icedid_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-07_a11a38b8593e36a27ea26c1a02ac82ed_cobalt-strike_icedid_satacom.exe"
1⤵
PID:5092

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004DC 0x00000000000004E8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3716