0fc5cbdcb15987ee838d1328297caf687ba5d0ac11037c2a427b8591088a7bdd

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 14:05

Target
2026-09-24_1afb1e26b928e06f8a4cc786065b1a6c_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe
Size 916KB
Sample260925-rd1ebatwez
SHA256 0fc5cbdcb15987ee838d1328297caf687ba5d0ac11037c2a427b8591088a7bdd
MD5 1afb1e26b928e06f8a4cc786065b1a6c
SHA1 a7f17150995e0d169b14bb56456b275a4e8f5151
SHA512 98d3c33da8d92db3482ece5209e16ca272f7146f7c6502a8b9838578eca5937240166b849579ce58cf32d42f2c95421c9d92ec4490a022a68cbb4997833676f0
SSDEEP 12288:iD3JeU7vinrmVD3JeU7vinrmb3bY1gL5pRTcAkS/3hzN8qE43fm78V:iD5TvinrmVD5Tvinrmbrt5jcAkSYqyE
TLSH
T109150715B2688F65D07FD178C5D2969AEA733C464F208BCB0281BE783E376D19939723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3380	2026-09-24_1afb1e26b928e06f8a4cc786065b1a6c_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe
3380	2026-09-24_1afb1e26b928e06f8a4cc786065b1a6c_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-24_1afb1e26b928e06f8a4cc786065b1a6c_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-24_1afb1e26b928e06f8a4cc786065b1a6c_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3380