32c4d850a0a7acb9f1acf3e6720a6f31a97c0062e7553415fec4bbccfe198618

Analysis

max time kernel
150s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/10/2026, 16:32

Target
2026-09-30_32344d5de5ea9997b276256034d8f0e0_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe
Size 1.4MB
Sample261001-t14flaydkc
SHA256 32c4d850a0a7acb9f1acf3e6720a6f31a97c0062e7553415fec4bbccfe198618
MD5 32344d5de5ea9997b276256034d8f0e0
SHA1 34581cbe4749725b674d1c019165b6157b2b5f69
SHA512 d81a260581682a8b7a23fc2fde60686ddb3db8936cdf1d97b101d8a64ceb5ecd81af86464fc5c84893617d08847f2fc539d3c1bb0591e37e413ccfcf94e0c576
SSDEEP 24576:iD5TvinrmdCKaEBiXKaBhYTqMi8CtBd2QHCHmTBW5M45jcAkSYqyE:k56rkqJtb2IMpYq
TLSH
T1E1651915F6648B21D07BC0B9C5D2969AEA333C425F308BCB1285DB683E276D6D936733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4888	2026-09-30_32344d5de5ea9997b276256034d8f0e0_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe
4888	2026-09-30_32344d5de5ea9997b276256034d8f0e0_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-30_32344d5de5ea9997b276256034d8f0e0_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_32344d5de5ea9997b276256034d8f0e0_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4888