Analysis
- max time kernel
149s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
14/07/2026, 03:34
General
- Target 2026-07-14_87a2bf16979daca772f02bf253432829_cobalt-strike_conti.exe
- Size 177KB
- Sample260714-d4yfradv6j
- SHA256 444c969f63985823d4fda9c9e6db6969cd5d1558ce07e4e595c1036dea15ad5f
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 26 IoCs
- Suspicious use of AdjustPrivilegeToken 22 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-14_87a2bf16979daca772f02bf253432829_cobalt-strike_conti.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-14_87a2bf16979daca772f02bf253432829_cobalt-strike_conti.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users\Public' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2724-0-0x00000000001C0000-0x00000000001C9000-memory.dmp
memory/2724-1-0x00007FFE65D10000-0x00007FFE65D22000-memory.dmp
memory/2724-41-0x0000000140000000-0x0000000140034000-memory.dmp
memory/3136-14-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp
memory/3136-16-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp
memory/3136-7-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp
memory/3136-8-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp
memory/3136-9-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp
memory/3136-10-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp
memory/3136-11-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp
memory/3136-12-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp
memory/3136-13-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp
memory/3136-3-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp
memory/3136-15-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp
memory/3136-6-0x000001A4EE3B0000-0x000001A4EE3D2000-memory.dmp
memory/3136-17-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp
memory/3136-18-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp
memory/3136-19-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp
memory/3136-25-0x000001A4EE9B0000-0x000001A4EEA62000-memory.dmp
memory/3136-26-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp
memory/3136-24-0x000001A4EE990000-0x000001A4EE9AE000-memory.dmp
memory/3136-30-0x000001A4EEA70000-0x000001A4EEA7A000-memory.dmp
memory/3136-34-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp
memory/3136-38-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp
memory/3136-40-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp
memory/3136-2-0x00007FFE4D74F000-0x00007FFE4D750000-memory.dmp