ab1389ef937541d795abe6eadca17d46c75fc2aab46c7d419f66540d08010149

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 13:32

Target
2026-10-22_502ab166cdde693f0fa8d8770752b491_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe
Size 852KB
Sample261024-qs2p9aas3x
SHA256 ab1389ef937541d795abe6eadca17d46c75fc2aab46c7d419f66540d08010149
MD5 502ab166cdde693f0fa8d8770752b491
SHA1 1c314882bd398fc5d97e8f9a0a1dcc8038dec130
SHA512 b8870e12961dfd76b8638186ab7dffcf61757fe5e1a39228faa9c5581a9722a0ab4b09cfe37bb46bd2f4f903f2fb29202d40719cc0694618561ca69a0b790145
SSDEEP 24576:iD5TvinrmXGpcAYTqMi8CtBd2QHCHmTBW5:k56rSqJtb2I
TLSH
T1CE050825F5688F61D07FC079C5D2969AEA333C425F308BCB0245AE683E376D5993A723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4120	2026-10-22_502ab166cdde693f0fa8d8770752b491_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe
4120	2026-10-22_502ab166cdde693f0fa8d8770752b491_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-22_502ab166cdde693f0fa8d8770752b491_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_502ab166cdde693f0fa8d8770752b491_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4120