Threat video1:00
contis.exe Themida Loader Chain: Detection & IOCs
PowerShell loader pulls contis.exe over HTTPS and rebuilds its payload in memory. 9 detection rules, 7 IOCs and a free Splunk SPL rule.
Read the full threat intel for contis.exe Themida Loader Chain: Detection & IOCs →
Chapters
- 0:00The hookAbout 3-stage malware loader in memory.
- 0:04The storyPowerShell mimics Activation Scripts, then downloads.
- 0:11Attack pathPowerShell downloads contis.exe from the server.
- 0:27AttributionNo threat actor is attributed.
- 0:32Indicators of compromise4 indicators to hunt: 1 domain and 3 file names.
- 0:37MITRE ATT&CK techniques9 ATT&CK techniques, from execution to stealth.
- 0:42Remediation4 steps now: Hunt for PowerShell processes that download and execute external executables.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00About 3-stage malware loader in memory.
0:05PowerShell mimics Activation Scripts, then downloads.
0:08It rebuilds native code in memory.
0:12PowerShell downloads contis.exe from the server.
0:15Environment checks halt if debugger detected.
0:18Reconstructs hidden code using cryptography.
0:22Persists as LocalSystem service.
0:27No threat actor is attributed. Confidence: low.
0:324 indicators to hunt: 1 domain and 3 file names.
0:389 ATT&CK techniques, from execution to stealth.
0:434 steps now: Hunt for PowerShell processes that download and execute external executables.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.