9c57e7104a155b6bd6436192a58b80109b5bc85830d1c3e0f860d08127294aa9

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 12:09

Target
2026-09-23_27e81629d8bbb6f0d89eeecb8579fe73_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe
Size 1.0MB
Sample260924-pbznwsde39
SHA256 9c57e7104a155b6bd6436192a58b80109b5bc85830d1c3e0f860d08127294aa9
MD5 27e81629d8bbb6f0d89eeecb8579fe73
SHA1 f87c5af8834ded4d3a9a1845dbee019043cab83e
SHA512 3180eb8148368c0b87ec30cb359be604ff9bbe11b071d75c14309aded0e3aac7b12fe9fe7f0d8c185949d734ebad92d6b3e2c52b1baf327bf4fbe335842dc6ea
SSDEEP 24576:iD5TvinrmdjQyr2X3OaoOaoYYTqMi8CtBd2QHCHmTBW5:k56r5qJtb2I
TLSH
T1CF251825F6A88F65E07FC075C5D2569AEA733C425F3087CB1245AE283E376D1993A323
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3016	2026-09-23_27e81629d8bbb6f0d89eeecb8579fe73_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe
3016	2026-09-23_27e81629d8bbb6f0d89eeecb8579fe73_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-23_27e81629d8bbb6f0d89eeecb8579fe73_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-23_27e81629d8bbb6f0d89eeecb8579fe73_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3016