95bd6107d71262ba0792cc441addeb057ef7b4bd266a3db9ca3d527db33dbf59

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 14:30

Target
2026-08-04_b495094ee4c7eb845ab453123e1135be_conti.exe
Size 746KB
Sample260804-rvcdtasfnc
SHA256 95bd6107d71262ba0792cc441addeb057ef7b4bd266a3db9ca3d527db33dbf59
MD5 b495094ee4c7eb845ab453123e1135be
SHA1 3a5225a54fa7f010f45f33431a721863b25c90ce
SHA512 3c9cfd92a63fb7b0053ceb0492d9ae74fba8be70f4a6308793b8ea4da03b8d32893d5db117abbb96f1f44a0efb39b8dae275b17d487ad58837e4918f2bbac88e
SSDEEP 12288:HWjq5H+e4RGCE67JFSO6/QFmSH280jcdQoLl:2O5H+lRGeAXF80jcdQoLl
TLSH
T1F5F4188336DB0CFAEE93273854DB533A6735FE708B6A8B6B4514D2311D139C1AD2AB41
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
behavioral2/memory/3204-0-0x00007FF62AC70000-0x00007FF62ACDE000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3204	2026-08-04_b495094ee4c7eb845ab453123e1135be_conti.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-04_b495094ee4c7eb845ab453123e1135be_conti.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_b495094ee4c7eb845ab453123e1135be_conti.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:3204