Analysis
- max time kernel
149s - max time network
96s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
17/04/2026, 04:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-17_3c421904beaeebcb2c9b46b83dbceece_conti.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-17_3c421904beaeebcb2c9b46b83dbceece_conti.exe
Resource
win11-20260130-en
windows11-21h2-x64
7 signatures
150 seconds
General
- Target 2026-04-17_3c421904beaeebcb2c9b46b83dbceece_conti.exe
- Size 913KB
- Sample260417-e62rmaft8k
- SHA256 812e94bf9c5eab08ecde6df12a67b3e4bf50b9f64c47aee4f3b51d51cb1a802a
- MD5 3c421904beaeebcb2c9b46b83dbceece
- SHA1 77ad4b13ebf1ba1770d273af244bdf83b4bdd565
- SHA512 62ef956dff65614820d2eed92cab170a3171295210e3e1a5a19c573952bea16bcd03ee380128ffda9f72f5c35df3935d6175da45063b32ede1cdacf0dabbc6b9
- SSDEEP 12288:+UuEFLrnGPNxWUajuFNnxboyq7rkQmkq5fd+bSYuL6K2OCDkzPcv9Xos7JRr5W8O:+8LrGVLboyq7rkQm3LcDeP69zDQ
- TLSH T1AC15BEBB6B5A6BEEC22B5E70AA853379D330742E13166DCB5424D738284DCC4CE74AD4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3124 Process not Found - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3124 set thread context of 4636 3124 Process not Found 80 - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4472 2026-04-17_3c421904beaeebcb2c9b46b83dbceece_conti.exe 4472 2026-04-17_3c421904beaeebcb2c9b46b83dbceece_conti.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3124 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4472 2026-04-17_3c421904beaeebcb2c9b46b83dbceece_conti.exe Token: SeShutdownPrivilege 3124 Process not Found Token: SeCreatePagefilePrivilege 3124 Process not Found Token: SeShutdownPrivilege 3124 Process not Found Token: SeCreatePagefilePrivilege 3124 Process not Found Token: SeShutdownPrivilege 3124 Process not Found Token: SeCreatePagefilePrivilege 3124 Process not Found Token: SeShutdownPrivilege 3124 Process not Found Token: SeCreatePagefilePrivilege 3124 Process not Found Token: SeShutdownPrivilege 3124 Process not Found Token: SeCreatePagefilePrivilege 3124 Process not Found Token: SeShutdownPrivilege 3124 Process not Found Token: SeCreatePagefilePrivilege 3124 Process not Found Token: SeShutdownPrivilege 3124 Process not Found Token: SeCreatePagefilePrivilege 3124 Process not Found Token: SeShutdownPrivilege 3124 Process not Found Token: SeCreatePagefilePrivilege 3124 Process not Found Token: SeShutdownPrivilege 3124 Process not Found Token: SeCreatePagefilePrivilege 3124 Process not Found Token: SeShutdownPrivilege 3124 Process not Found Token: SeCreatePagefilePrivilege 3124 Process not Found Token: SeShutdownPrivilege 3124 Process not Found Token: SeCreatePagefilePrivilege 3124 Process not Found Token: SeShutdownPrivilege 3124 Process not Found Token: SeCreatePagefilePrivilege 3124 Process not Found Token: SeShutdownPrivilege 3124 Process not Found Token: SeCreatePagefilePrivilege 3124 Process not Found Token: SeShutdownPrivilege 3124 Process not Found Token: SeCreatePagefilePrivilege 3124 Process not Found Token: SeShutdownPrivilege 3124 Process not Found Token: SeCreatePagefilePrivilege 3124 Process not Found Token: SeShutdownPrivilege 3124 Process not Found Token: SeCreatePagefilePrivilege 3124 Process not Found Token: SeShutdownPrivilege 3124 Process not Found Token: SeCreatePagefilePrivilege 3124 Process not Found Token: SeShutdownPrivilege 3124 Process not Found Token: SeCreatePagefilePrivilege 3124 Process not Found Token: SeShutdownPrivilege 3124 Process not Found Token: SeCreatePagefilePrivilege 3124 Process not Found Token: SeShutdownPrivilege 3124 Process not Found Token: SeCreatePagefilePrivilege 3124 Process not Found Token: SeShutdownPrivilege 3124 Process not Found Token: SeCreatePagefilePrivilege 3124 Process not Found Token: SeShutdownPrivilege 3124 Process not Found Token: SeCreatePagefilePrivilege 3124 Process not Found Token: SeShutdownPrivilege 3124 Process not Found Token: SeCreatePagefilePrivilege 3124 Process not Found Token: SeShutdownPrivilege 3124 Process not Found Token: SeCreatePagefilePrivilege 3124 Process not Found Token: SeShutdownPrivilege 3124 Process not Found Token: SeCreatePagefilePrivilege 3124 Process not Found Token: SeShutdownPrivilege 3124 Process not Found Token: SeCreatePagefilePrivilege 3124 Process not Found Token: SeShutdownPrivilege 3124 Process not Found Token: SeCreatePagefilePrivilege 3124 Process not Found Token: SeShutdownPrivilege 3124 Process not Found Token: SeCreatePagefilePrivilege 3124 Process not Found Token: SeShutdownPrivilege 3124 Process not Found Token: SeCreatePagefilePrivilege 3124 Process not Found Token: SeShutdownPrivilege 3124 Process not Found Token: SeCreatePagefilePrivilege 3124 Process not Found Token: SeShutdownPrivilege 3124 Process not Found Token: SeCreatePagefilePrivilege 3124 Process not Found Token: SeShutdownPrivilege 3124 Process not Found - Suspicious use of UnmapMainImage 1 IoCs
pid Process 3124 Process not Found - Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 3124 wrote to memory of 4636 3124 Process not Found 80 PID 3124 wrote to memory of 4636 3124 Process not Found 80 PID 3124 wrote to memory of 4636 3124 Process not Found 80 PID 3124 wrote to memory of 4636 3124 Process not Found 80 PID 3124 wrote to memory of 4636 3124 Process not Found 80 PID 3124 wrote to memory of 4636 3124 Process not Found 80 PID 3124 wrote to memory of 4636 3124 Process not Found 80 PID 3124 wrote to memory of 4636 3124 Process not Found 80 PID 3124 wrote to memory of 4636 3124 Process not Found 80 PID 3124 wrote to memory of 4636 3124 Process not Found 80 PID 3124 wrote to memory of 4636 3124 Process not Found 80 PID 3124 wrote to memory of 4636 3124 Process not Found 80 PID 3124 wrote to memory of 4636 3124 Process not Found 80 PID 3124 wrote to memory of 4636 3124 Process not Found 80 PID 3124 wrote to memory of 4636 3124 Process not Found 80 PID 3124 wrote to memory of 4636 3124 Process not Found 80 PID 3124 wrote to memory of 4636 3124 Process not Found 80 PID 3124 wrote to memory of 4636 3124 Process not Found 80 PID 3124 wrote to memory of 4636 3124 Process not Found 80 PID 3124 wrote to memory of 4636 3124 Process not Found 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-17_3c421904beaeebcb2c9b46b83dbceece_conti.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-17_3c421904beaeebcb2c9b46b83dbceece_conti.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4472
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe1⤵PID:4636
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\u_240659796.dll
- Size 514KB
- SHA256 03e9ebbeb9e33969313e1cc4c6d82d1dec6f35799ded0ef5a8896c88496d8b82
- MD5 cb1093a0a89e7ff9e8509a33b41ac79c
- SHA1 c477d9a861a43aa34c1bf82106ce4536ac5e3feb
- SHA512 60a835f8180adb8417612257ec2b3a0234e97f802b5265ef2d80404fe682af9a84d5ac460dc6871f19799239e7808a3413f66a2ac449de6e9cfa756872cee609
- SSDEEP 12288:wI4Q0C80leMfmx0zlqYe8/KxIoj68pFobNVgf87NF:xZ0KleMoAqYebxIojxzo4f+
- TLSH T1D5B49E07F7936DFCC217C130866B9376B635B09913247E7B0B98D7332E61E904A1AE65
- MD5 SHA1 SHA512 SSDEEP TLSH