4403f8d914481f059c0f7f61e8164575bd6a190d6fc4674c7b1c9e0639ab947a

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/09/2026, 12:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-28_bfd883ad781ae2e6ec8d41bbea7b66cc_conti.exe
Size 260KB
Sample260928-pfsfdaaf63
SHA256 4403f8d914481f059c0f7f61e8164575bd6a190d6fc4674c7b1c9e0639ab947a
MD5 bfd883ad781ae2e6ec8d41bbea7b66cc
SHA1 a82fc0ba2a3b5dc5210d62883ea1e39aa82474ba
SHA512 db998c0cb9478b5285f92a06223a1c16631cc94efd464d52a15abede8f3f8714bf0bb8435235d1f7eb70b0b87e42dffd819c8d3f946b4aaa9bc542ba51a48910
SSDEEP 3072:KIMIA7pNKbkwxFhdR8myRr0KDrYMSGwMsmLx6mwDcFW5hvrJibeHmSWnJ4rt5pKT:KPSERr0pIwMAf8beHlE+FMVf
TLSH
T165446D85FBC5ACEACA160235899F43793338FBD116879B170D29B2351E23AD0ED86747
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5124	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-28_bfd883ad781ae2e6ec8d41bbea7b66cc_conti.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-28_bfd883ad781ae2e6ec8d41bbea7b66cc_conti.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3584 wrote to memory of 5124	3584	2026-09-28_bfd883ad781ae2e6ec8d41bbea7b66cc_conti.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-09-28_bfd883ad781ae2e6ec8d41bbea7b66cc_conti.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-28_bfd883ad781ae2e6ec8d41bbea7b66cc_conti.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:3584
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\tXqrRYc.exe"
  2⤵
  - Executes a command shell one-liner
  PID:5124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tXqrRYc.exe

Path C:\Users\Admin\tXqrRYc.exe
Size 82KB
SHA256 95e1d7e2a1559ae83d00aa5537dfacdf5091f6d072a551db5d110b618d721a35
MD5 e60f3d313b39c2238d93facab6c0beb5
SHA1 2c66d75b1eb748fd8138459f0724db4f45ebe578
SHA512 bb11ebca0d3622baad9268533e961b81b57f5be506bb1d9c26adefd44f9944d8c35db1883e7c15454e2bb156a5cb5e274c3f902951550b6f57fb3501f6bb85bc
SSDEEP 1536:pboRBRC6Hjq9y0UBOcpHXZ/jybGgRWWOVFQi2C3iir+:YRGUBHogWOo
TLSH
T10A8308B9B1A170235B13F970402F910FB97B646BE44C0DA8F294DCE16DF698A8473F69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3584-14-0x00007FF7F4DD0000-0x00007FF7F4E12000-memory.dmp

Download