0429829a8f6170dbc9de4b4d30d2dbec7e3f4853896a5171f8cc45900028ba6d

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/09/2026, 16:04

Target
2026-09-29_d26c7de85c65905e10d8aa37c483f641_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe
Size 832KB
Sample260929-th4nmswdnc
SHA256 0429829a8f6170dbc9de4b4d30d2dbec7e3f4853896a5171f8cc45900028ba6d
MD5 d26c7de85c65905e10d8aa37c483f641
SHA1 0dab1a073c495ca8b6687ed84f3a44e780c04878
SHA512 0f446257305da6c3aa770fde91790c4290e2071bcb4105aa8f82574cb1df63b7820cebabb82f507174dccd94cb7fdbe807e47023c0c48c46753a7e70948494c9
SSDEEP 24576:iD5Tvinrm5OaEBYDa8A3a45jcAkSYqyE:k56r9pYq
TLSH
T129051715F6648F61D07FC079C5D2969AEA733C464F308BCB0385AE683E276D1993A363
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4948	2026-09-29_d26c7de85c65905e10d8aa37c483f641_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe
4948	2026-09-29_d26c7de85c65905e10d8aa37c483f641_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-29_d26c7de85c65905e10d8aa37c483f641_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_d26c7de85c65905e10d8aa37c483f641_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4948