Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
02/11/2026, 11:10
General
- Target 2026-11-01_b46f8036e9d3851373c30461beffa2ad_cobalt-strike_conti.exe
- Size 234KB
- Sample261102-m97faag16z
- SHA256 c1a308bb49460214e6539e39a7535f407ba90fc517709ab8a14c34d6c28ce777
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 11 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-01_b46f8036e9d3851373c30461beffa2ad_cobalt-strike_conti.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-01_b46f8036e9d3851373c30461beffa2ad_cobalt-strike_conti.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\fodhelper.exe"C:\Windows\system32\fodhelper.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Notepad.exe"C:\Windows\System32\Notepad.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2808-0-0x00007FFB23A5F000-0x00007FFB23A60000-memory.dmp
memory/2808-1-0x00007FF644EB0000-0x00007FF644EE6000-memory.dmp
memory/2808-2-0x00007FFB238D0000-0x00007FFB24274000-memory.dmp
memory/2808-3-0x00007FFB238D0000-0x00007FFB24274000-memory.dmp
memory/2808-4-0x0000028523300000-0x000002852330A000-memory.dmp
memory/2808-14-0x00007FFB238D0000-0x00007FFB24274000-memory.dmp
memory/2808-21-0x00007FFB238D0000-0x00007FFB24274000-memory.dmp
memory/2808-22-0x00007FFB238D0000-0x00007FFB24274000-memory.dmp
memory/2808-23-0x00007FF644EB0000-0x00007FF644EE6000-memory.dmp
memory/2808-26-0x00007FFB238D0000-0x00007FFB24274000-memory.dmp
memory/2808-39-0x00007FF644EB0000-0x00007FF644EE6000-memory.dmp
memory/2808-40-0x00007FFB238D0000-0x00007FFB24274000-memory.dmp