Analysis
- max time kernel
148s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
18/07/2026, 02:51
General
- Target 2026-07-17_970c6a4c376ea750148d729d80ae08bc_conti.exe
- Size 105KB
- Sample260718-db5dlady6l
- SHA256 1e028e45a9bbc93b927c8a9465a8758ccb84f831bfe31c4fb9591b3a09bdd53c
Malware Config
Signatures
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Modifies registry class 19 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of WriteProcessMemory 3 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_970c6a4c376ea750148d729d80ae08bc_conti.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-17_970c6a4c376ea750148d729d80ae08bc_conti.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exeschtasks.exe /Create /TN "\Microsoft\Windows\BqjFaVr1\B7J5B1XcNa" /TR "\"C:\ProgramData\KlL1EhzvGi\Z2FJtAY8jM.exe\"" /SC ONLOGON /RL HIGHEST /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\RuntimeBroker.exe"C:\Windows\system32\RuntimeBroker.exe"2⤵
-
-
C:\ProgramData\KlL1EhzvGi\Z2FJtAY8jM.exe"C:\ProgramData\KlL1EhzvGi\Z2FJtAY8jM.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\RuntimeBroker.exe"C:\Windows\system32\RuntimeBroker.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
2Ptl1liCJt.dll
Z2FJtAY8jM.exe
memory/808-6-0x00007FF630620000-0x00007FF630640000-memory.dmp
memory/808-21-0x00007FF630620000-0x00007FF630640000-memory.dmp
memory/2592-7-0x00007FF793390000-0x00007FF79339C000-memory.dmp
memory/2592-8-0x00007FF813CB0000-0x00007FF813CBE000-memory.dmp
memory/2592-27-0x00007FF793390000-0x00007FF79339C000-memory.dmp
memory/2592-28-0x00007FF813CB0000-0x00007FF813CBE000-memory.dmp
memory/2684-24-0x000001DAF4F70000-0x000001DAF4F71000-memory.dmp
memory/4388-18-0x000001C85A220000-0x000001C85A221000-memory.dmp