# Multi-Stage Windows PowerShell Loader Chain Delivering Themida/UPX-Protected Native Payload (contis.exe) with In-Memory Cryptographic Reconstruction

> Aryaka Threat Research Lab (Aditya K Sood, Bikash Dash, 2026-11-02) traced a multi-stage Windows infection chain that starts with a PowerShell loader associated with get.activated.win (deceptive Microsoft Activation Scripts activity), retrieves contis.exe from srv.conti.pk over HTTPS with PE validation, and reconstructs a ~4.19 MiB non-PE buffer in memory using layered cryptography. No malware family name, actor, or CVE is stated in the readable source material.

- **Published:** 2026-11-04T14:42:38Z
- **Last reviewed:** 2026-11-04T14:42:38Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5242
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5242.png
- **ID:** TL-2026-5242
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** MONITORING
- **Detections:** 9 (1 shown free below) · **IOCs:** 7 (2 shown free below)

## Description

Aryaka Threat Research Lab published 'Peeling Back the Layers of PowerShell Loader: Tracing a Multi-Stage Windows Payload Chain' on 2026-11-02. The full PDF exceeds the 10 MB fetch limit, so this record is built from the Aryaka blog summary, the Aryaka report landing page, the malware.news post and the Malpedia library entry only; details that appear only in the PDF (hashes, full URLs, detailed MITRE mapping, malware family) were not read and are not asserted.

Sourced infection chain: (1) a PowerShell loader associated with get.activated.win, with the report landing page describing privilege escalation, deceptive Microsoft Activation Scripts (MAS) activity, randomized file execution and delayed cleanup; (2) a native payload, contis.exe, retrieved from srv.conti.pk over HTTPS with PE validation; (3) a final runtime stage reconstructed in memory. The reconstructed buffer is approximately 4.19 MiB, has no valid PE structure, and is moved into dynamically allocated memory and prepared for execution from private memory not backed by a conventional PE image, using VirtualAlloc, VirtualProtect and CreateThread with memory-protection transitions. The landing page also states persistence via a Windows service running under the LocalSystem account.

The reconstruction applies HKDF key derivation and multiple transformations: RC4, ChaCha20-Poly1305, AES-256-GCM and AES-256-CBC. The payload performs environment-aware anti-analysis checks covering debugger state, PEB debugging state, hardware-debugging state, system resources, hypervisor presence and other host characteristics. Static analysis shows an unusually large virtual BSS region, a .text section with zero raw size, and unusual section names including 'themida' and 'UPX2'.

Caution on attribution of indicators: get.activated.win is publicly documented as the legitimate domain of the open-source Microsoft Activation Scripts (MAS) project (usage: irm https://get.activated.win | iex), and public MAS guidance warns that malware is spread via look-alike URLs. Aryaka only says the loader is 'associated with' this domain / MAS-related; it is not confirmed whether the domain itself serves malicious content or is the lure/context. Do not block it blindly without validating against the report's loader URL. srv.conti.pk and contis.exe are the payload host and filename per Aryaka. The name resemblance to the 'Conti' ransomware brand is not evidence of a link and none is asserted.

The landing page lists ATT&CK techniques as 'inferred' (T1134 privilege escalation, T1543.003 Windows service persistence, process hollowing/module stomping); the mapping here uses only those with direct textual support and treats the rest as unconfirmed.

Severity MEDIUM and status MONITORING are analyst placeholders. Exploitability, actor, motivation and victimology are not stated in the readable sources. Aryaka's separate DonutLoader report ('Beyond the Batch File') is by the same team but the link to this report is not confirmed.

Detection guidance from the source: monitor for PowerShell retrieving external executables from unusual infrastructure, connections to the identified domains, large private memory allocations followed by executable-memory transitions, environment/debugger checks by newly launched processes, and correlate behavior across stages instead of relying on isolated indicators.

## MITRE ATT&CK

- T1059.001 PowerShell
- T1027 Obfuscated Files or Information
- T1027.002 Software Packing
- T1140 Deobfuscate/Decode Files or Information
- T1620 Reflective Code Loading
- T1622 Debugger Evasion
- T1497.001 System Checks
- T1622 Debugger Evasion
- T1497.001 System Checks
- T1543.003 Windows Service
- T1543.003 Windows Service
- T1036 Masquerading

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**PowerShell Loader Retrieving External Executable (contis.exe / srv.conti.pk) - Exploitation Phase** (`TL-2026-5242-SPL-001`)

Detects Stage 1 of the TL-2026-5242 chain: powershell.exe or pwsh.exe whose command line references the named payload host srv.conti.pk or payload contis.exe, or combines a download cmdlet/method (irm, iwr, Invoke-WebRequest, DownloadFile, Start-BitsTransfer) with a .exe target, or pipes content from the get.activated.win (MAS look-alike) domain into iex. Based on Aryaka's guidance to monitor PowerShell retrieving external executables from unusual infrastructure (T1059.001, T1105). get.activated.win is also the legitimate MAS domain, so that branch is a lower-fidelity hunting signal.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1059.001, T1105
- **Data sources:** sysmon, windows_security_4688_commandline, microsoft_defender_for_endpoint
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

```spl
index=windows sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (Image="*powershell.exe" OR Image="*pwsh.exe") | eval dl=if(match(CommandLine,"(?i)(invoke-restmethod|invoke-webrequest|downloadfile|downloadstring|start-bitstransfer|[ (;](irm|iwr)[ ])"),1,0) | eval ioc=if(match(CommandLine,"(?i)(srv[.]conti[.]pk|contis[.]exe)"),1,0) | eval exe=if(match(CommandLine,"(?i)[.]exe"),1,0) | eval mas=if(match(CommandLine,"(?i)activated[.]win.*[|][ ]*(iex|invoke-expression)"),1,0) | where ioc=1 OR (dl=1 AND exe=1) OR mas=1 | eval reason=case(ioc=1,"TL-2026-5242 IOC srv.conti.pk/contis.exe",dl=1 AND exe=1,"PowerShell download of executable",mas=1,"irm|iex from get.activated.win (validate URL)") | stats count min(_time) as firstTime max(_time) as lastTime values(CommandLine) as CommandLine values(ParentImage) as ParentImage values(reason) as reason by host User Image | convert ctime(firstTime) ctime(lastTime)
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ('powershell.exe', 'pwsh.exe')
| where ProcessCommandLine has_any ('srv.conti.pk', 'contis.exe')
    or (ProcessCommandLine has_any ('irm', 'iwr', 'Invoke-RestMethod', 'Invoke-WebRequest', 'DownloadFile', 'DownloadString', 'Start-BitsTransfer') and ProcessCommandLine contains '.exe')
    or (ProcessCommandLine has 'activated.win' and ProcessCommandLine has_any ('iex', 'Invoke-Expression'))
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc
```

### Sigma

```yaml
title: PowerShell Loader Retrieving External Executable - TL-2026-5242
id: 5c1e7a52-3b8d-4f0a-9d71-2a6c0e4b8f11
status: experimental
description: Detects PowerShell command lines referencing srv.conti.pk or contis.exe, downloading an executable, or piping get.activated.win content into iex (multi-stage loader chain reported by Aryaka 2026-11-02).
references:
    - https://www.aryaka.com/blog/powershell-loader-multi-stage-windows-malware-analysis/
    - https://www.aryaka.com/reports-and-guides/peeling-back-the-layers-of-powershell-loader/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-04
tags:
    - attack.execution
    - attack.t1059.001
    - attack.command_and_control
    - attack.t1105
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
    selection_ioc:
        CommandLine|contains:
            - 'srv.conti.pk'
            - 'contis.exe'
    selection_dl:
        CommandLine|contains:
            - 'Invoke-WebRequest'
            - 'Invoke-RestMethod'
            - 'DownloadFile'
            - 'DownloadString'
            - 'Start-BitsTransfer'
            - ' irm '
            - ' iwr '
    selection_exe:
        CommandLine|contains: '.exe'
    selection_mas:
        CommandLine|contains|all:
            - 'activated.win'
            - 'iex'
    condition: selection_img and (selection_ioc or (selection_dl and selection_exe) or selection_mas)
falsepositives:
    - Administrators legitimately running the public Microsoft Activation Scripts one-liner (irm https://get.activated.win | iex)
    - Software deployment scripts that download signed installers with Invoke-WebRequest
level: high

```

**Known false positives:**

- Legitimate use of the public MAS one-liner from get.activated.win by IT staff (the domain is the real MAS project domain, not proof of compromise)
- Software deployment or patching scripts that download installers with Invoke-WebRequest or Start-BitsTransfer

**Tuning notes:** Treat the srv.conti.pk / contis.exe branch as high fidelity and the get.activated.win branch as hunting-grade; validate the exact loader URL before blocking. Allow-list known deployment hosts and signed installer URLs by parent process or account. Adjust the index name to your Sysmon index.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- [indicator] Payload Execution or File Drop ([indicator]/UPX2-Packed Native Payload) (locked: unlock with TL Creds)
- PowerShell Script Block Showing Layered Crypto Reconstruction (HKDF/RC4/ChaCha20-Poly1305/AES-GCM/AES-CBC) (locked: unlock with TL Creds)
- Large Executable Private Memory Allocation / Protection Transition (~4.19 MiB Non-PE Buffer) (locked: unlock with TL Creds)
- PowerShell Anti-Debug and Hypervisor/Environment Checks in Script Block (locked: unlock with TL Creds)
- PowerShell Delayed Self-Cleanup of Staged Files (Start-Sleep + Remove-Item in User-Writable Paths) (locked: unlock with TL Creds)
- PowerShell-Spawned Randomly Named Executable From User-Writable Path (locked: unlock with TL Creds)
- DNS/Network Contact with Payload Host [indicator] or PowerShell Contact with [indicator] - C2/Delivery (locked: unlock with TL Creds)
- New LocalSystem Windows Service Launching from User-Writable Path - Persistence (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (2 of 7)

Defanged, TLP:CLEAR.

- Domain: `srv[.]conti[.]pk`
- Domain: `get[.]activated[.]win`

Full set of 7 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Peeling Back the Layers of PowerShell Loader: Tracing a Multi-Stage Windows Payload Chain (Aryaka report PDF)](https://www.aryaka.com/docs/reports/peeling-back-the-layers-of-powershell-loader.pdf)
- [Peeling Back the Layers of PowerShell Loader (Aryaka report landing page)](https://www.aryaka.com/reports-and-guides/peeling-back-the-layers-of-powershell-loader/)
- [PowerShell Loader Malware Analysis: Multi-Stage Windows Payload Execution (Aryaka blog)](https://www.aryaka.com/blog/powershell-loader-multi-stage-windows-malware-analysis/)
- [Malpedia library entry](https://malpedia.caad.fkie.fraunhofer.de/library/4f1ccdb1-c552-45e4-8463-a6be18da5004/)
- [Malware News: Peeling Back the Layers of PowerShell Loader](https://malware.news/t/peeling-back-the-layers-of-powershell-loader-tracing-a-multi-stage-windows-payload-chain/126940)
- [Aryaka Threat Research Lab](https://www.aryaka.com/threat-research-lab/)
- [Aryaka DonutLoader multi-stage loader report (related, link to this chain unconfirmed)](https://www.aryaka.com/docs/reports/donutloader-multi-stage-loader-report.pdf)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5242