1dd638069fd731e802c57009c0176fa3ff7ec0119aacc1082db94584579a066c

Analysis

max time kernel
148s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 18:41

Target
2026-08-17_8f702d0efaea988b5e7b5aef5794c1fb_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe
Size 1.1MB
Sample260817-xbxtasxwhy
SHA256 1dd638069fd731e802c57009c0176fa3ff7ec0119aacc1082db94584579a066c
MD5 8f702d0efaea988b5e7b5aef5794c1fb
SHA1 e1f3140ccb03a6f1713e3119cc4933c6103f0352
SHA512 be0828b25ce6c764244d356cd1e6a40e7742c4cfac084949c4fbb4e9da1404d90a15eb8c403f5437a4ae59d3c049ce64ab43259663d9d827cd21792896ee79c9
SSDEEP 24576:iD5TvinrmdjQyr2X3OaoZ5D5TvinrmVD5TvinrmbLCD5TvinrmC:k56rS56ru56rH56rX
TLSH
T1BF454906A2984FA5D66F9174DD9246A6E6737C428F114BDF0350BF3A3E327C0AE39253
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2420	2026-08-17_8f702d0efaea988b5e7b5aef5794c1fb_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe
2420	2026-08-17_8f702d0efaea988b5e7b5aef5794c1fb_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-17_8f702d0efaea988b5e7b5aef5794c1fb_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_8f702d0efaea988b5e7b5aef5794c1fb_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2420