5e5b0c2a3c09cfc5ad2e5fd253169afaf1bccecd9dc0ca0c53c5013618dfa599

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 00:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_ac1c3a6c64f8b7830c34d868688b5a64_conti.exe
Size 260KB
Sample261024-bblkdadh88
SHA256 5e5b0c2a3c09cfc5ad2e5fd253169afaf1bccecd9dc0ca0c53c5013618dfa599
MD5 ac1c3a6c64f8b7830c34d868688b5a64
SHA1 14e89636aadbd3aafc50efc3273f27473dd36ed9
SHA512 41bc4b570f5c42c2dabbbc8487226a6597da232fc625a9550ed115217f42dafd2f2e0e37e3bc9eee0c73d77ccbe5d1c17c0e3947a03775df29ba5f2b95e91f2b
SSDEEP 3072:fZMIA7pNKbkwxFhdR8mvRr0KDrYMSGwMsmLx6mwDcFW5hvrJibeHmSWnJ4rt5pKT:fmShRr0pIwMAf8beHlE+FMVf
TLSH
T13F446D85FBC5ACEACA160235899F43793338FBD116879B170D29B2351E23AD0ED86747
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3124	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-22_ac1c3a6c64f8b7830c34d868688b5a64_conti.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-22_ac1c3a6c64f8b7830c34d868688b5a64_conti.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4604 wrote to memory of 3124	4604	2026-10-22_ac1c3a6c64f8b7830c34d868688b5a64_conti.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-10-22_ac1c3a6c64f8b7830c34d868688b5a64_conti.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_ac1c3a6c64f8b7830c34d868688b5a64_conti.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:4604
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\SOJsZM.exe"
  2⤵
  - Executes a command shell one-liner
  PID:3124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SOJsZM.exe

Path C:\Users\Admin\SOJsZM.exe
Size 84KB
SHA256 6291acb9a07445dba6509c31cff46b02ecee17c81e1f77c366b4ee7747ee53ac
MD5 cf43876ccaad3a63de5adca7fc842cf9
SHA1 239915c8596d01afb009bc25b844612ed365c0ca
SHA512 3041b57345ae25281f02f9d0f09f24c3b3057fd373c1930c6fdb10d7f59da2a9584ef65c94834b3c035173f903d8334ae035b6738bbcf85607d83e1aebd584bb
SSDEEP 1536:FsdB7Q9/jqxaUUxl/RmJaJyCVmwW1pwdQi2I3WSpS:axUxlS91ptX
TLSH
T10783E8B9B1A1B0335A13F870412F500FB97BA46BE44C0DA8F254DCE16EF598A8477B6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4604-14-0x00007FF76A390000-0x00007FF76A3D2000-memory.dmp

Download