0d7708ef64c08ef4f9fb7bf26787f3fd2aad66ec48b34b6134fb957ca01e4ddd

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 13:59

Target
2026-09-24_1c96be1d20fca6cab19a45673f571bef_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe
Size 2.7MB
Sample260925-ralrraee82
SHA256 0d7708ef64c08ef4f9fb7bf26787f3fd2aad66ec48b34b6134fb957ca01e4ddd
MD5 1c96be1d20fca6cab19a45673f571bef
SHA1 f0b60d4c24246e0ed0f0fcc1b83b284b4f7e1df8
SHA512 305e15644e73d49e2e399e97c575d7168246eae0d6bee14a87d745ee557709bcebc3bd08be93d98174ee1bf5add5e6fb55154746092c49509dc54fa2b7ff01bf
SSDEEP 49152:k56r+qJtb2IEeW4SkZP4sz9MbfqJtb2IQPji0Aj:hr+FfkZcfZjo
TLSH
T1D3D5E915F5788722D077D0B9C5D2AA9AFE3238465F308ACB0246DB6C3E276D6C536732
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4108	2026-09-24_1c96be1d20fca6cab19a45673f571bef_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe
4108	2026-09-24_1c96be1d20fca6cab19a45673f571bef_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-24_1c96be1d20fca6cab19a45673f571bef_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-24_1c96be1d20fca6cab19a45673f571bef_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4108