3b313cea50dd3c616b2f9929e7877d0833d9e46da6830c51670c0e76d4babfbc

Analysis

max time kernel
148s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 14:19

Target
2026-11-07_524f73a6c18daefb23e589275c80cb64_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe
Size 2.4MB
Sample261107-rm1rfayydv
SHA256 3b313cea50dd3c616b2f9929e7877d0833d9e46da6830c51670c0e76d4babfbc
MD5 524f73a6c18daefb23e589275c80cb64
SHA1 9a62a440a54b1cd3e1320949b2e9fc93228e94f2
SHA512 e9456587ea2f3880acf577368d45bb5b9c01bf15c9a07f2499c30e5577b7fe604f9e7b1cd2274031dc5ab87734ed809a0e2144fb11839f68f3992b957529fcaf
SSDEEP 49152:k56r8pYq+56ru56rsRJHPji0AjvqJtb2Ip:hr86srbrsR5jozO
TLSH
T1EFB52A15F6648F65D07FC079C5D2969AEA333C424F308BCB0285AF683E276D5993A723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4256	2026-11-07_524f73a6c18daefb23e589275c80cb64_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe
4256	2026-11-07_524f73a6c18daefb23e589275c80cb64_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-11-07_524f73a6c18daefb23e589275c80cb64_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-07_524f73a6c18daefb23e589275c80cb64_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4256