d673cd98811e8d1df74b8479aa1aef6b037da06a9a84c4746e4dc0569a7d7b73

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 16:33

Target
2026-09-23_00382ab32280b864f75370bea87ee00f_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe
Size 4.5MB
Sample260925-t2pc3asv4l
SHA256 d673cd98811e8d1df74b8479aa1aef6b037da06a9a84c4746e4dc0569a7d7b73
MD5 00382ab32280b864f75370bea87ee00f
SHA1 b8c25e5dfe34821fcb7398d5ec7771982bb3e6dd
SHA512 8b1ef46659ecdcff1109a2bb9c7295784c8be2c9afdc96b38d035c40ea772a11baa9ed765ba60247282836a86c35f56ae24918466a1cb26e4f5f108142efad5b
SSDEEP 49152:k56rbeW4SkZP4sz9Mb3eW4SkZP4sz9MbKqJtb2I0qJtb2IEeW4SkZP4sz9MbBPjy:hr7fkZcHfkZcKXFfkZcRjo
TLSH
T13B260815F5788722D0B3C0B9C5D7AA9AFD3238465B308ACB0246E76C2E376D6C536736
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1252	2026-09-23_00382ab32280b864f75370bea87ee00f_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe
1252	2026-09-23_00382ab32280b864f75370bea87ee00f_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-23_00382ab32280b864f75370bea87ee00f_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-23_00382ab32280b864f75370bea87ee00f_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1252