c4396cf99b4a74295ec73bdfbc31d8917020197337547816a06048bfde5eca18

Analysis

max time kernel
148s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 03:03

Target
2026-08-03_388b7307d491d5fe994f80764e6cbb46_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe
Size 583KB
Sample260804-dkcd6st1by
SHA256 c4396cf99b4a74295ec73bdfbc31d8917020197337547816a06048bfde5eca18
MD5 388b7307d491d5fe994f80764e6cbb46
SHA1 e033a4ba7d7f11fdde96e7f2a376105b21d39414
SHA512 0c532a4339860190d860b0c2a9f0d8bf074757c596e4511be69d290543f6c894f33b8071319a170556b5e6262c41d5974164d438b87ec1bb5629f46fa727f93d
SSDEEP 12288:iD3JeU7vinrmF0DpV4ruEMD3JeU7vinrmZf:iD5TvinrmF+pV4ruEMD5TvinrmZf
TLSH
T1D5D45B0676984FA5E26F8174D9A245A6E7737C129F1187CF0360BE293F327C0AE79253
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4832	2026-08-03_388b7307d491d5fe994f80764e6cbb46_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe
4832	2026-08-03_388b7307d491d5fe994f80764e6cbb46_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-03_388b7307d491d5fe994f80764e6cbb46_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_388b7307d491d5fe994f80764e6cbb46_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4832