3f70dea78ffed24e383bf24a1af3a2902706a6439e43ceb686314adba6bc6e67

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 18:26

Target
2026-10-22_2911be98cea52217888fb3d51ad2985e_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe
Size 425KB
Sample261024-w269zswtet
SHA256 3f70dea78ffed24e383bf24a1af3a2902706a6439e43ceb686314adba6bc6e67
MD5 2911be98cea52217888fb3d51ad2985e
SHA1 a3ae3c87f874187a7a7608d2e6a01f890081bda5
SHA512 268611350e469514c38f0f6cdd5806de5f26a937498738dbe8064d5448da3336428c4d3e3fc5006611dbffa9ee09761e6cbcbec5a2f1b765017fc3451cd1954b
SSDEEP 6144:iDmt4JZg2p7LrimEHcGuvvNFsI5ay8dnYa7fII4OT8nKio:iD3JeU7vinrmdoTpYagjicbo
TLSH
T1F6948D16A5984FA5E21F8170E4D105A6EA737D029F5183CF1358BE253F327C0BE792AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4820	2026-10-22_2911be98cea52217888fb3d51ad2985e_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe
4820	2026-10-22_2911be98cea52217888fb3d51ad2985e_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-22_2911be98cea52217888fb3d51ad2985e_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_2911be98cea52217888fb3d51ad2985e_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4820