4403f8d914481f059c0f7f61e8164575bd6a190d6fc4674c7b1c9e0639ab947a

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/09/2026, 12:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-28_bfd883ad781ae2e6ec8d41bbea7b66cc_conti.exe
Size 260KB
Sample260928-pfsfdaaf63
SHA256 4403f8d914481f059c0f7f61e8164575bd6a190d6fc4674c7b1c9e0639ab947a
MD5 bfd883ad781ae2e6ec8d41bbea7b66cc
SHA1 a82fc0ba2a3b5dc5210d62883ea1e39aa82474ba
SHA512 db998c0cb9478b5285f92a06223a1c16631cc94efd464d52a15abede8f3f8714bf0bb8435235d1f7eb70b0b87e42dffd819c8d3f946b4aaa9bc542ba51a48910
SSDEEP 3072:KIMIA7pNKbkwxFhdR8myRr0KDrYMSGwMsmLx6mwDcFW5hvrJibeHmSWnJ4rt5pKT:KPSERr0pIwMAf8beHlE+FMVf
TLSH
T165446D85FBC5ACEACA160235899F43793338FBD116879B170D29B2351E23AD0ED86747
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	2026-09-28_bfd883ad781ae2e6ec8d41bbea7b66cc_conti.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4404	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-28_bfd883ad781ae2e6ec8d41bbea7b66cc_conti.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-28_bfd883ad781ae2e6ec8d41bbea7b66cc_conti.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 4404	1280	2026-09-28_bfd883ad781ae2e6ec8d41bbea7b66cc_conti.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-09-28_bfd883ad781ae2e6ec8d41bbea7b66cc_conti.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-28_bfd883ad781ae2e6ec8d41bbea7b66cc_conti.exe"
1⤵
- Checks computer location settings
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\wRVJuAH.exe"
  2⤵
  - Executes a command shell one-liner
  PID:4404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wRVJuAH.exe

Path C:\Users\Admin\wRVJuAH.exe
Size 82KB
SHA256 9cc40b411e32806585e72b14f8b76b13328ceca9fe34fd5413ffaaa6a9498cea
MD5 29c3f7a64f81bf5ce97acaf2afe84aff
SHA1 497e278c1d73eecc009798b91acde628b795a418
SHA512 ffa5c05bd392398b22d5d32287671c9f44d8b557a7d8ae8b368a00b8f2bbf63e70c953e674aba7f692df342ca85d11e6d6befe2c4d156db1f899b58828a3fa8a
SSDEEP 1536:fIGoMBRC6Hjq9y0UBOcpHXZ/0yM+yQWWOVFQi2C3ihrL:hRGUBHidWOO
TLSH
T1FB83F9B9B1A170225B23F970402F410FB97B686BE84C0DA8F254DCE16DF69898477F6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1280-14-0x00007FF72C410000-0x00007FF72C452000-memory.dmp

Download