cd34372d6973880f63088713abd11d0ec3bc8040fcec8cd71baa10d14eaaf85f

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 16:35

Target
2026-09-29_ca71799856400b7ad1181813e05c96ac_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe
Size 956KB
Sample260930-t35fns1emd
SHA256 cd34372d6973880f63088713abd11d0ec3bc8040fcec8cd71baa10d14eaaf85f
MD5 ca71799856400b7ad1181813e05c96ac
SHA1 eb2cf34fc9d0d41456e8ca283c6e556f7d83b38e
SHA512 51532e322a7505f08a1d69593d0d66466029bd9c138b3f3f36aeda3a6623d1c270e873e83348fb62effcda39530344dbd92a3e8026d470fb16109a0a35795155
SSDEEP 24576:iD5TvinrmdCKaEBiXKapVL0Le5ji0hmxNrM:k56rJPji0Aj
TLSH
T1A0252816F6644F61D07FC079C5D2569AEA733C425F308BCB0355AE683E276D29A3A323
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5636	2026-09-29_ca71799856400b7ad1181813e05c96ac_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe
5636	2026-09-29_ca71799856400b7ad1181813e05c96ac_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-29_ca71799856400b7ad1181813e05c96ac_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ca71799856400b7ad1181813e05c96ac_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:5636

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1616