18af5d832f24e9e04c1d76ee1f11c0a45d3e0cf795fb57245b424980c996188a

Analysis

max time kernel
0s
max time network
3s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 08:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
2026-08-24_83d002b8d1a82f2dfadf07b0fea10058_conti.exe
Size 104KB
Sample260825-kveevayhpg
SHA256 18af5d832f24e9e04c1d76ee1f11c0a45d3e0cf795fb57245b424980c996188a
MD5 83d002b8d1a82f2dfadf07b0fea10058
SHA1 f7a96d3f2f8165f52d0078bd19ea1a1f5daac23e
SHA512 802912016776a004fe0ed00db9a3251fce6f7217f84a8c0c28f056dbdf81d1d2020ee77bf20160a6e24ea7b0da6012621449c4ed4af3f2e64de6bbd1e4184115
SSDEEP 1536:fFlGZV9dMY3w00bcmqgR5yCynD53iDDWG4QkSA8vWnozSMNDF80imYFMn7o9T/I7:fXGfbZ6D6G4TpnojlvYFU7oZ6
TLSH
T107A3E6E066D85D87EA24177C45D6D322223EF6E087538B03E634B6361F13BD1B9C626E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion execution upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral2/memory/6112-0-0x00007FF6A3970000-0x00007FF6A39A1000-memory.dmp	UPX

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/6112-0-0x00007FF6A3970000-0x00007FF6A39A1000-memory.dmp	upx

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4688	cmd.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
5096	taskkill.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 6112 wrote to memory of 4688	6112	2026-08-24_83d002b8d1a82f2dfadf07b0fea10058_conti.exe	89
PID 4688 wrote to memory of 5096	4688	cmd.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-24_83d002b8d1a82f2dfadf07b0fea10058_conti.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-24_83d002b8d1a82f2dfadf07b0fea10058_conti.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:6112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c TASKKILL /F /T /IM wininit.exe
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4688
- - C:\Windows\system32\taskkill.exe
    TASKKILL /F /T /IM wininit.exe
    3⤵
    - Kills process with taskkill
    PID:5096

C:\Windows\system32\ctfmon.exe
/QuitInfo:0000000000000270;0000000000000274;
1⤵
PID:3140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/6112-0-0x00007FF6A3970000-0x00007FF6A39A1000-memory.dmp

Download