0109a6f7ce5c1faa75b734504ffdc55cdd54ea7852020013c4946de84932819a

Analysis

max time kernel
150s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/11/2026, 16:49

Target
2026-11-11_1706676ec50fccdfb72cae0a1453cdfe_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe
Size 529KB
Sample261113-vb6ebsdy7m
SHA256 0109a6f7ce5c1faa75b734504ffdc55cdd54ea7852020013c4946de84932819a
MD5 1706676ec50fccdfb72cae0a1453cdfe
SHA1 0675218a303f2db35646f36f13b03d8ec7e59ddb
SHA512 528429933f90fd0bc4d72a8e5a83ca39dca0db134d36959ec29f7584ec4d7b64cf7ec72efc895e86d8717d5274cfaff40ac54e3e71ac9be87ab9f50e39b3c97c
SSDEEP 12288:iD3JeU7vinrm5EQ0kaW0qeD3JeU7vinrmC:iD5Tvinrm5EQLaWTeD5TvinrmC
TLSH
T156B4491672984FA9D12F9174D99245A6E7733C129F2187CF1390BE293F367C0AE3A253
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1632	2026-11-11_1706676ec50fccdfb72cae0a1453cdfe_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe
1632	2026-11-11_1706676ec50fccdfb72cae0a1453cdfe_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-11-11_1706676ec50fccdfb72cae0a1453cdfe_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-11_1706676ec50fccdfb72cae0a1453cdfe_amadey_cobalt-strike_hijackloader_satacom_vidar_wannacry.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1632