Analysis
- max time kernel
149s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
02/11/2026, 11:10
General
- Target 2026-11-01_b46f8036e9d3851373c30461beffa2ad_cobalt-strike_conti.exe
- Size 234KB
- Sample261102-m97faag16z
- SHA256 c1a308bb49460214e6539e39a7535f407ba90fc517709ab8a14c34d6c28ce777
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 11 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-01_b46f8036e9d3851373c30461beffa2ad_cobalt-strike_conti.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-01_b46f8036e9d3851373c30461beffa2ad_cobalt-strike_conti.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\fodhelper.exe"C:\Windows\system32\fodhelper.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Notepad.exe"C:\Windows\System32\Notepad.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/732-24-0x0000021E1E600000-0x0000021E1ED57000-memory.dmp
memory/1336-0-0x00007FF6E8680000-0x00007FF6E86B6000-memory.dmp
memory/1336-1-0x00007FF6E868D000-0x00007FF6E8696000-memory.dmp
memory/1336-2-0x00007FF6E8680000-0x00007FF6E86B6000-memory.dmp
memory/1336-3-0x0000012532E40000-0x0000012532E4A000-memory.dmp
memory/1336-13-0x00007FF6E868D000-0x00007FF6E8696000-memory.dmp
memory/1336-23-0x00007FF6E8680000-0x00007FF6E86B6000-memory.dmp