3fde9ceb9f911ffe001d4a2268a647ee20076623a5f866b447009e7693551427

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/09/2026, 17:32

Target
2026-09-26_a1d15be0884a7365e35b142036521bc0_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe
Size 1.6MB
Sample260926-v4dvsaybmb
SHA256 3fde9ceb9f911ffe001d4a2268a647ee20076623a5f866b447009e7693551427
MD5 a1d15be0884a7365e35b142036521bc0
SHA1 a222badf6f7bfa48f5b39c0dab0328a99e9fdcf8
SHA512 ad6fe6985322be4e599c1cc75e8dfed5d8c1619f3d320fca04fb1aa0daeb59f59c3f6da009a831dec2375cd88d11d7a4cf3f24313015e9dc25f3eff5c4b4f40e
SSDEEP 24576:iD5Tvinrmdoc2Q145jcAkSYqyExZe0p4Ek4niOkl/A04szE87JKTvm:k56rrpYqLeW4SkZP4sz9Mb
TLSH
T1C875F815F5788B22D0B7C0B9C5D2AA9AFA3338465F308BCB0245DB6C3E276D68535736
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4280	2026-09-26_a1d15be0884a7365e35b142036521bc0_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe
4280	2026-09-26_a1d15be0884a7365e35b142036521bc0_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-26_a1d15be0884a7365e35b142036521bc0_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-26_a1d15be0884a7365e35b142036521bc0_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4280