8069d74b63b75b83f992e6dc1ec6a730f851aaa523f1b4e6b51bf3569aa4f9b4

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 11:00

Target
2026-09-24_45bc6c9c4083e014e5c41ae28d90c9cf_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe
Size 1.9MB
Sample260925-m4e4vazyez
SHA256 8069d74b63b75b83f992e6dc1ec6a730f851aaa523f1b4e6b51bf3569aa4f9b4
MD5 45bc6c9c4083e014e5c41ae28d90c9cf
SHA1 bfff17e41d6c1ceba49ea712bd5647f8dd3f198e
SHA512 764add23b84b345081e8678035f95f7e29d2c6dc1859554bdf34eff53d498e6ee584b8443732a6b11d3bc7a3f710c79967bca3174ef9f5302868f92fe33806b1
SSDEEP 49152:k56rIeW4SkZP4sz9MbpeW4SkZP4sz9Mb:hr0fkZcdfkZc
TLSH
T11F95E715F5788723D0B7C0B9C5D7AA99FA3338455F308ACB0246DB2C2E276D6853673A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4548	2026-09-24_45bc6c9c4083e014e5c41ae28d90c9cf_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe
4548	2026-09-24_45bc6c9c4083e014e5c41ae28d90c9cf_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-24_45bc6c9c4083e014e5c41ae28d90c9cf_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-24_45bc6c9c4083e014e5c41ae28d90c9cf_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4548

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5964