ace9764db19653b5034845cd7478560269d014e847fadd7cbee02deb8b81f1b1

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 13:29

Target
2026-08-02_e3b77caca4b95e4dd327dbd94587c9bd_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe
Size 1.6MB
Sample260802-qrf26azxcx
SHA256 ace9764db19653b5034845cd7478560269d014e847fadd7cbee02deb8b81f1b1
MD5 e3b77caca4b95e4dd327dbd94587c9bd
SHA1 fdf1cbf9353c0ba74356c37f4ed1e0dcda46d156
SHA512 107439493ddf3521f84baea5780deb686e40d324483609af43c023bb639a5d0e33b896d5e51b2ccad724a402e4b6508e1c20a4285cec17c297f6c5d1988f4c1a
SSDEEP 24576:iD5TvinrmF+pC5jcAkSYqyExZe0p4Ek4niOkl/A04szE87JKTvm:k56r8pYqLeW4SkZP4sz9Mb
TLSH
T14F75F815F6788B22D0B7C0B9C5D2AA9AFA3338455F308BCB0245DB6C3E276D68535736
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5048	2026-08-02_e3b77caca4b95e4dd327dbd94587c9bd_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe
5048	2026-08-02_e3b77caca4b95e4dd327dbd94587c9bd_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-02_e3b77caca4b95e4dd327dbd94587c9bd_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_e3b77caca4b95e4dd327dbd94587c9bd_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:5048