Analysis
- max time kernel
148s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/06/2026, 02:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-27_dda1dbdcddbcaa989d57d09a4831ed02_conti.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-27_dda1dbdcddbcaa989d57d09a4831ed02_conti.exe
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target 2026-06-27_dda1dbdcddbcaa989d57d09a4831ed02_conti.exe
- Size 83KB
- Sample260629-cmb1rab17p
- SHA256 13f891e88d0764f1758150e63d3ccf3e60604e3bfe3e4ffcaa0153ca56a8bbeb
- MD5 dda1dbdcddbcaa989d57d09a4831ed02
- SHA1 8c611d2774856648be564b035f0d199f7b999d4f
- SHA512 7e6f581f1acc6f7388c33677130b483f6fabeac57acbe6ed4c29b7cfddd971f6171ced168ba0738d9ec7121e1882f919adf382761b0207efbf54ed1a50d3417c
- SSDEEP 1536:rLVxAMBX/m58NLJkwxzBnRfCMaI4qmNj81pofEcCs17dbYj3q4WfsLe6607Wvn:rLVxAMBX/HDkwxzB5W3qmNNEcCwFsM0g
- TLSH T1DA836C16F293A0FCEA16C07445DA1673E972BC6A01309F3EE783EB341E34D51AE99619
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral2/memory/4432-20-0x00007FF6C7E30000-0x00007FF6C7E49000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 1 raw.githubusercontent.com 5 raw.githubusercontent.com - Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 api.ipify.org 2 api.ipify.org - Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 1872 WMIC.exe - Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 4432 2026-06-27_dda1dbdcddbcaa989d57d09a4831ed02_conti.exe 4432 2026-06-27_dda1dbdcddbcaa989d57d09a4831ed02_conti.exe 1872 WMIC.exe 1872 WMIC.exe 1872 WMIC.exe 1872 WMIC.exe 4788 WMIC.exe 4788 WMIC.exe 4788 WMIC.exe 4788 WMIC.exe 5012 WMIC.exe 5012 WMIC.exe 5012 WMIC.exe 5012 WMIC.exe 1264 WMIC.exe 1264 WMIC.exe 1264 WMIC.exe 1264 WMIC.exe 3568 WMIC.exe 3568 WMIC.exe 3568 WMIC.exe 3568 WMIC.exe 5672 WMIC.exe 5672 WMIC.exe 5672 WMIC.exe 5672 WMIC.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1872 WMIC.exe Token: SeSecurityPrivilege 1872 WMIC.exe Token: SeTakeOwnershipPrivilege 1872 WMIC.exe Token: SeLoadDriverPrivilege 1872 WMIC.exe Token: SeSystemProfilePrivilege 1872 WMIC.exe Token: SeSystemtimePrivilege 1872 WMIC.exe Token: SeProfSingleProcessPrivilege 1872 WMIC.exe Token: SeIncBasePriorityPrivilege 1872 WMIC.exe Token: SeCreatePagefilePrivilege 1872 WMIC.exe Token: SeBackupPrivilege 1872 WMIC.exe Token: SeRestorePrivilege 1872 WMIC.exe Token: SeShutdownPrivilege 1872 WMIC.exe Token: SeDebugPrivilege 1872 WMIC.exe Token: SeSystemEnvironmentPrivilege 1872 WMIC.exe Token: SeRemoteShutdownPrivilege 1872 WMIC.exe Token: SeUndockPrivilege 1872 WMIC.exe Token: SeManageVolumePrivilege 1872 WMIC.exe Token: 33 1872 WMIC.exe Token: 34 1872 WMIC.exe Token: 35 1872 WMIC.exe Token: 36 1872 WMIC.exe Token: SeIncreaseQuotaPrivilege 1872 WMIC.exe Token: SeSecurityPrivilege 1872 WMIC.exe Token: SeTakeOwnershipPrivilege 1872 WMIC.exe Token: SeLoadDriverPrivilege 1872 WMIC.exe Token: SeSystemProfilePrivilege 1872 WMIC.exe Token: SeSystemtimePrivilege 1872 WMIC.exe Token: SeProfSingleProcessPrivilege 1872 WMIC.exe Token: SeIncBasePriorityPrivilege 1872 WMIC.exe Token: SeCreatePagefilePrivilege 1872 WMIC.exe Token: SeBackupPrivilege 1872 WMIC.exe Token: SeRestorePrivilege 1872 WMIC.exe Token: SeShutdownPrivilege 1872 WMIC.exe Token: SeDebugPrivilege 1872 WMIC.exe Token: SeSystemEnvironmentPrivilege 1872 WMIC.exe Token: SeRemoteShutdownPrivilege 1872 WMIC.exe Token: SeUndockPrivilege 1872 WMIC.exe Token: SeManageVolumePrivilege 1872 WMIC.exe Token: 33 1872 WMIC.exe Token: 34 1872 WMIC.exe Token: 35 1872 WMIC.exe Token: 36 1872 WMIC.exe Token: SeIncreaseQuotaPrivilege 4788 WMIC.exe Token: SeSecurityPrivilege 4788 WMIC.exe Token: SeTakeOwnershipPrivilege 4788 WMIC.exe Token: SeLoadDriverPrivilege 4788 WMIC.exe Token: SeSystemProfilePrivilege 4788 WMIC.exe Token: SeSystemtimePrivilege 4788 WMIC.exe Token: SeProfSingleProcessPrivilege 4788 WMIC.exe Token: SeIncBasePriorityPrivilege 4788 WMIC.exe Token: SeCreatePagefilePrivilege 4788 WMIC.exe Token: SeBackupPrivilege 4788 WMIC.exe Token: SeRestorePrivilege 4788 WMIC.exe Token: SeShutdownPrivilege 4788 WMIC.exe Token: SeDebugPrivilege 4788 WMIC.exe Token: SeSystemEnvironmentPrivilege 4788 WMIC.exe Token: SeRemoteShutdownPrivilege 4788 WMIC.exe Token: SeUndockPrivilege 4788 WMIC.exe Token: SeManageVolumePrivilege 4788 WMIC.exe Token: 33 4788 WMIC.exe Token: 34 4788 WMIC.exe Token: 35 4788 WMIC.exe Token: 36 4788 WMIC.exe Token: SeIncreaseQuotaPrivilege 4788 WMIC.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4432 wrote to memory of 3768 4432 2026-06-27_dda1dbdcddbcaa989d57d09a4831ed02_conti.exe 91 PID 3768 wrote to memory of 1872 3768 cmd.exe 93 PID 4432 wrote to memory of 5540 4432 2026-06-27_dda1dbdcddbcaa989d57d09a4831ed02_conti.exe 95 PID 5540 wrote to memory of 4788 5540 cmd.exe 97 PID 4432 wrote to memory of 3932 4432 2026-06-27_dda1dbdcddbcaa989d57d09a4831ed02_conti.exe 98 PID 3932 wrote to memory of 5012 3932 cmd.exe 100 PID 4432 wrote to memory of 3576 4432 2026-06-27_dda1dbdcddbcaa989d57d09a4831ed02_conti.exe 101 PID 3576 wrote to memory of 1264 3576 cmd.exe 103 PID 4432 wrote to memory of 5568 4432 2026-06-27_dda1dbdcddbcaa989d57d09a4831ed02_conti.exe 104 PID 5568 wrote to memory of 3568 5568 cmd.exe 106 PID 4432 wrote to memory of 4072 4432 2026-06-27_dda1dbdcddbcaa989d57d09a4831ed02_conti.exe 107 PID 4072 wrote to memory of 5672 4072 cmd.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-27_dda1dbdcddbcaa989d57d09a4831ed02_conti.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-27_dda1dbdcddbcaa989d57d09a4831ed02_conti.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Windows\SYSTEM32\cmd.execmd.exe /c wmic path win32_videocontroller get name2⤵
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_videocontroller get name3⤵
- Detects videocard installed
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1872
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c wmic bios get serialnumber2⤵
- Suspicious use of WriteProcessMemory
PID:5540 -
C:\Windows\System32\Wbem\WMIC.exewmic bios get serialnumber3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4788
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c wmic baseboard get manufacturer2⤵
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Windows\System32\Wbem\WMIC.exewmic baseboard get manufacturer3⤵
- Suspicious behavior: EnumeratesProcesses
PID:5012
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c wmic baseboard get serialnumber2⤵
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Windows\System32\Wbem\WMIC.exewmic baseboard get serialnumber3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1264
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c wmic cpu get serialnumber2⤵
- Suspicious use of WriteProcessMemory
PID:5568 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get serialnumber3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3568
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c wmic diskdrive get serialnumber2⤵
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Windows\System32\Wbem\WMIC.exewmic diskdrive get serialnumber3⤵
- Suspicious behavior: EnumeratesProcesses
PID:5672
-
-