eec0cf5ca7fa8bb71d9e73ad553de36804f4af2ab11bbfcf3d5ef26feec080e3

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/10/2026, 01:19

Target
2026-10-22_f8e9770ef240c6d286143cf759c26d5f_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe
Size 449KB
Sample261023-bph2eag12s
SHA256 eec0cf5ca7fa8bb71d9e73ad553de36804f4af2ab11bbfcf3d5ef26feec080e3
MD5 f8e9770ef240c6d286143cf759c26d5f
SHA1 245daae0d67c77c0a99e7f2cd31d2f20cc6f325c
SHA512 a6bd4aa49404e61f6dc89fc0f752d656bfd5d86c35060ba75a2f38ca39d8d90ec020f7ace7f9181b6b32a8f8b8b16a57d284c5b4c790f5fef1cd3a4a1a06ace9
SSDEEP 6144:iDmt4JZg2p7LrimEHcGuvvNFsI5azIRJke+8YT2Re0yenVC9Riw:iD3JeU7vinrmdocjPXcR0TsQw
TLSH
T194A47C16A5984FA5E21F8170E4D10596EA737D039F5183CF1368BE253F327C0AE792AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5196	2026-10-22_f8e9770ef240c6d286143cf759c26d5f_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe
5196	2026-10-22_f8e9770ef240c6d286143cf759c26d5f_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-22_f8e9770ef240c6d286143cf759c26d5f_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_f8e9770ef240c6d286143cf759c26d5f_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:5196