Overview

overview

10

Static

static

3

Conti-0xb.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    102s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/04/2025, 01:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Conti-0xb.exe

  • Size

    225KB

  • MD5

    4cd1bdd51aad677e34b28eb8fdbb8713

  • SHA1

    15f0d03511fb8b97e8e25e2c88ce287a3daeacd7

  • SHA256

    8cc0af07f6a734190daa831d3636db4d88a5c9e74872ebcfb3aa9b5beea77804

  • SHA512

    a41f63165c721db042ed7be26f93c7703dbaca0e502051ea9723ffa077285f21683138d3874a6854264a4d0b5c46be02a0590113475fd8366c6e08f5ab1de52b

  • SSDEEP

    3072:n6syAG2L/wgMrxFSbY3Fq5dQWQC0F0+aLTZtjaPPZMtcdlrRMC/T2wc:6iG2EgwFSc3U5dv0FOTDaPPZMEfBc

Score
10/10
credential_accessdiscoveryransomwarespywarestealer

Malware Config

Extracted

Path

C:\Program Files\readme.txt

Ransom Note
All your files are encrypted and the backup is corrupted. Don't worry, only our team can recover files. We only accept BTC transactions for payment. Before payment, you can submit 1 file for decryption testing. The file cannot be a backup, database, key, and the file cannot exceed 80kb. Hopefully the head of the organization will contact us directly. We have no other purpose. We just want money. We have always been honest. There has been a period of time in your organization and obtained almost all of your applications, people, dealers, products and other data. If we are ignored, this incident will be made public. Sell ​​your data. Contacting us as soon as possible is the best way for everyone. Contact us tox.id: "F03697478C23619141468DF39D14C3EBAECF1D93EF0AE14A14338741141C566671CB3F4C3A1A" If you do not contact us to pay the ransom within 7 days, the amount will double. 1. Do not restart the operating system or isolate the LAN. 2. Do not modify the encrypted file without authorization. If an encryption barrier occurs, some files cannot be recovered by the decryption key and we will not be held responsible. ---BEGIN ID--- bLkGYvN43a3tVNzPJrQGfNEQgFhqFSSmCdCSQABgOyLPZNKGgmfYktRw510bKGsR ---END ID---

Signatures

  • Renames multiple (8702) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Drops startup file 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 31 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\Conti-0xb.exe
    "C:\Users\Admin\AppData\Local\Temp\Conti-0xb.exe"
    1⤵
    • Drops startup file
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5988
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{79F6F000-E03E-451B-8DE5-CB62582963BB}'" delete
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1032
      • C:\Windows\System32\wbem\WMIC.exe
        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{79F6F000-E03E-451B-8DE5-CB62582963BB}'" delete
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1792
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4120

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\readme.txt
    Filesize

    1KB

    MD5

    660eda8beb19aa786aef553e4acd5e2d

    SHA1

    af91338ae07c572c63f6a8be6b545b8cbc622033

    SHA256

    5e6358684bdebf64d888bc73fae8d96322eaf58902cbe8c6242680b1f1055fcd

    SHA512

    eb39284f206be8b4b5ad1b6662770d86ef3d9dba540cddf44b82a2e227d0cb594cce469745d6d9d2ba912aea2fde0b9784c081460d1c694710cafbe77b3e7b4a

    Download Submit