bc493af107ea27870408d228170d2d15223c7ebe4d9684067d5ac592f6746383

General

Target
2026-08-24_4e19ad2642f4c35af375fb03826eb645_conti.exe
Size 104KB
Sample260825-qypb4stamd
SHA256 bc493af107ea27870408d228170d2d15223c7ebe4d9684067d5ac592f6746383
MD5 4e19ad2642f4c35af375fb03826eb645
SHA1 9f7e28c4c7a1611e6b5893a0e05771692892361f
SHA512 4c7614bfaed57d2347680be89302f167988083caff9556540acb84c0f18565598fba6e21e02fe29d3571ce584aa359ba062858f767da9f08e429a4087ea79535
SSDEEP 1536:cFlGZV9dMY3w00bcm/dLkxI9XTi8vWnizSMNDF80imYFMn7o9T/I7:cXGfbQLSkXmnijlvYFU7oZ6
TLSH
T195A3D6D066D85D8AEA10177C45D6D322363EF6E487538B03E634B6361F13BD2B9C622E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Signatures

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral2/memory/5088-0-0x00007FF64B200000-0x00007FF64B231000-memory.dmp	UPX
behavioral2/memory/5088-2-0x00007FF64B200000-0x00007FF64B231000-memory.dmp	UPX

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5088-0-0x00007FF64B200000-0x00007FF64B231000-memory.dmp	upx
behavioral2/memory/5088-2-0x00007FF64B200000-0x00007FF64B231000-memory.dmp	upx

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4736	cmd.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
1356	taskkill.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4036	dwm.exe
4036	dwm.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1356	taskkill.exe
Token: SeCreateGlobalPrivilege	4036	dwm.exe
Token: SeChangeNotifyPrivilege	4036	dwm.exe
Token: 33	4036	dwm.exe
Token: SeIncBasePriorityPrivilege	4036	dwm.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5088 wrote to memory of 4736	5088	2026-08-24_4e19ad2642f4c35af375fb03826eb645_conti.exe	89
PID 4736 wrote to memory of 1356	4736	cmd.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-24_4e19ad2642f4c35af375fb03826eb645_conti.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-24_4e19ad2642f4c35af375fb03826eb645_conti.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c TASKKILL /F /T /IM winlogon.exe
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4736
- - C:\Windows\system32\taskkill.exe
    TASKKILL /F /T /IM winlogon.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1356

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:4016

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4036