Overview

overview

6

Static

static

3

2026-07-22...ti.exe

windows10-2004-x64

6

2026-07-22...ti.exe

windows11-ltsc_2024-x64

6

Analysis

  • max time kernel
    148s
  • max time network
    142s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    22/07/2026, 22:21

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-22_49638dd8287961f5ecb7c63ec2d03eef_cobalt-strike_conti.exe
  • Size 209KB
  • Sample260722-19yd9sch48
  • SHA256 92db7af95f465d001324dffc7abc129da4517ec7c999dabc13871f8dd83e3c3b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
executionpersistence

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Executes a command shell one-liner 1 TTPs 12 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-22_49638dd8287961f5ecb7c63ec2d03eef_cobalt-strike_conti.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-22_49638dd8287961f5ecb7c63ec2d03eef_cobalt-strike_conti.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1812
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c findstr /r "mfa\.[a-f0-9]" "C:\Users\Admin\AppData\Roaming\Discord\Local Storage\leveldb\*.log" 2>nul
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:3184
      • C:\Windows\system32\findstr.exe
        findstr /r "mfa\.[a-f0-9]" "C:\Users\Admin\AppData\Roaming\Discord\Local Storage\leveldb\*.log"
        3⤵
          PID:2000
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c findstr /r "mfa\.[a-f0-9]" "C:\Users\Admin\AppData\Roaming\discordptb\Local Storage\leveldb\*.log" 2>nul
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2080
        • C:\Windows\system32\findstr.exe
          findstr /r "mfa\.[a-f0-9]" "C:\Users\Admin\AppData\Roaming\discordptb\Local Storage\leveldb\*.log"
          3⤵
            PID:2460
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c findstr /r "mfa\.[a-f0-9]" "C:\Users\Admin\AppData\Roaming\discordcanary\Local Storage\leveldb\*.log" 2>nul
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:5260
          • C:\Windows\system32\findstr.exe
            findstr /r "mfa\.[a-f0-9]" "C:\Users\Admin\AppData\Roaming\discordcanary\Local Storage\leveldb\*.log"
            3⤵
              PID:5500
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c findstr /r "mfa\.[a-f0-9]" "C:\Users\Admin\AppData\Roaming\Discord\Local Storage\leveldb\*.log" 2>nul
            2⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:1004
            • C:\Windows\system32\findstr.exe
              findstr /r "mfa\.[a-f0-9]" "C:\Users\Admin\AppData\Roaming\Discord\Local Storage\leveldb\*.log"
              3⤵
                PID:2036
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c findstr /r "mfa\.[a-f0-9]" "C:\Users\Admin\AppData\Roaming\discordptb\Local Storage\leveldb\*.log" 2>nul
              2⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:5132
              • C:\Windows\system32\findstr.exe
                findstr /r "mfa\.[a-f0-9]" "C:\Users\Admin\AppData\Roaming\discordptb\Local Storage\leveldb\*.log"
                3⤵
                  PID:5560
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c findstr /r "mfa\.[a-f0-9]" "C:\Users\Admin\AppData\Roaming\discordcanary\Local Storage\leveldb\*.log" 2>nul
                2⤵
                • Executes a command shell one-liner
                • Suspicious use of WriteProcessMemory
                PID:1960
                • C:\Windows\system32\findstr.exe
                  findstr /r "mfa\.[a-f0-9]" "C:\Users\Admin\AppData\Roaming\discordcanary\Local Storage\leveldb\*.log"
                  3⤵
                    PID:3672
              • C:\Users\Admin\AppData\Local\Temp\2026-07-22_49638dd8287961f5ecb7c63ec2d03eef_cobalt-strike_conti.exe
                C:\Users\Admin\AppData\Local\Temp\2026-07-22_49638dd8287961f5ecb7c63ec2d03eef_cobalt-strike_conti.exe
                1⤵
                • Adds Run key to start application
                • Suspicious use of WriteProcessMemory
                PID:5456
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c findstr /r "mfa\.[a-f0-9]" "C:\Users\Admin\AppData\Roaming\Discord\Local Storage\leveldb\*.log" 2>nul
                  2⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:6060
                  • C:\Windows\system32\findstr.exe
                    findstr /r "mfa\.[a-f0-9]" "C:\Users\Admin\AppData\Roaming\Discord\Local Storage\leveldb\*.log"
                    3⤵
                      PID:5052
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c findstr /r "mfa\.[a-f0-9]" "C:\Users\Admin\AppData\Roaming\discordptb\Local Storage\leveldb\*.log" 2>nul
                    2⤵
                    • Executes a command shell one-liner
                    • Suspicious use of WriteProcessMemory
                    PID:1220
                    • C:\Windows\system32\findstr.exe
                      findstr /r "mfa\.[a-f0-9]" "C:\Users\Admin\AppData\Roaming\discordptb\Local Storage\leveldb\*.log"
                      3⤵
                        PID:1316
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c findstr /r "mfa\.[a-f0-9]" "C:\Users\Admin\AppData\Roaming\discordcanary\Local Storage\leveldb\*.log" 2>nul
                      2⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:4300
                      • C:\Windows\system32\findstr.exe
                        findstr /r "mfa\.[a-f0-9]" "C:\Users\Admin\AppData\Roaming\discordcanary\Local Storage\leveldb\*.log"
                        3⤵
                          PID:5748
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c findstr /r "mfa\.[a-f0-9]" "C:\Users\Admin\AppData\Roaming\Discord\Local Storage\leveldb\*.log" 2>nul
                        2⤵
                        • Executes a command shell one-liner
                        • Suspicious use of WriteProcessMemory
                        PID:2320
                        • C:\Windows\system32\findstr.exe
                          findstr /r "mfa\.[a-f0-9]" "C:\Users\Admin\AppData\Roaming\Discord\Local Storage\leveldb\*.log"
                          3⤵
                            PID:2964
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c findstr /r "mfa\.[a-f0-9]" "C:\Users\Admin\AppData\Roaming\discordptb\Local Storage\leveldb\*.log" 2>nul
                          2⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:2168
                          • C:\Windows\system32\findstr.exe
                            findstr /r "mfa\.[a-f0-9]" "C:\Users\Admin\AppData\Roaming\discordptb\Local Storage\leveldb\*.log"
                            3⤵
                              PID:6072
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c findstr /r "mfa\.[a-f0-9]" "C:\Users\Admin\AppData\Roaming\discordcanary\Local Storage\leveldb\*.log" 2>nul
                            2⤵
                            • Executes a command shell one-liner
                            • Suspicious use of WriteProcessMemory
                            PID:720
                            • C:\Windows\system32\findstr.exe
                              findstr /r "mfa\.[a-f0-9]" "C:\Users\Admin\AppData\Roaming\discordcanary\Local Storage\leveldb\*.log"
                              3⤵
                                PID:5684

                          Network

                                MITRE ATT&CK Enterprise v16

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                memory/1812-0-0x00007FF6B30A0000-0x00007FF6B30DC000-memory.dmp
                                Download

                                memory/5456-4-0x00007FF6B30A0000-0x00007FF6B30DC000-memory.dmp
                                Download