70f70050a22d58f39fb3a0f90556724e3f77e9180ae46857b9b735989cd2c7b6

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/07/2026, 02:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_fdfba4a5612d7a81ac07cd7a0e6456be_conti.exe
Size 990KB
Sample260731-csj9babc29
SHA256 70f70050a22d58f39fb3a0f90556724e3f77e9180ae46857b9b735989cd2c7b6
MD5 fdfba4a5612d7a81ac07cd7a0e6456be
SHA1 ca1491b346ae1546523007ae0cbf74003bbe8d20
SHA512 e77f3779f80b7a6bb00971db9207c7df6b0532f65a282c18eebd304ea7b4083a02c63749fa309cfaa5247582e2bc2d3471f9a3b8f482cfd1b752b44200d96cd7
SSDEEP 24576:zXP4K6TP4k5x3CiK9sPf4YpWKqjSUlbnh5:zAPP55x3+LYEVj5
TLSH
T13E25230DF631E445C5A1E6B810C18AF3BF62EED618962EBDAF845B255DB40CB1E81273
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2340	_0e58b969.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_0e58b969.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 2340	2096	2026-07-31_fdfba4a5612d7a81ac07cd7a0e6456be_conti.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-31_fdfba4a5612d7a81ac07cd7a0e6456be_conti.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_fdfba4a5612d7a81ac07cd7a0e6456be_conti.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Users\Admin\AppData\Local\Temp\_0e58b969.exe
  C:\Users\Admin\AppData\Local\Temp\\_0e58b969.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_0e58b969.exe

Path C:\Users\Admin\AppData\Local\Temp\_0e58b969.exe
Size 971KB
SHA256 fdf962adcdefad6bd99c5b95e2a9829a70e17dc0d5db59d78e14f70bffe594aa
MD5 730cbf7819321583d7709bbbc945eb9c
SHA1 5af3314b5fb7e10144df7ae8fd4fcbd234705a48
SHA512 871bde4a275715eacd04dc924367470d28799e4eae805b5c89834630a008ae4cfe5e70545d608d095c219645185bc0c372f2caedcaa759326d6402db0796db77
SSDEEP 12288:Z/xRnsHqxK3viiKuuTClI8cCJd5BskCuzkA92T31jnBOz866:ZpZsHq030T8cU5BHiFz
TLSH
T151251901A7A25034F8F725F959BE21BC993DBAD01B1490CF93C46BED9729AE17C3061B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2096-9-0x00007FF72B880000-0x00007FF72B97F000-memory.dmp

Download

memory/2340-4-0x0000000010000000-0x0000000010024000-memory.dmp