Analysis
- max time kernel
59s - max time network
61s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
- submitted
24/06/2026, 19:56
General
- Target 729d34221798360fcb7d79665392972be70845a741399ca9b5b4739a11926dd4.exe
- Size 513KB
- Sample260624-ynwmfaft6j
- SHA256 729d34221798360fcb7d79665392972be70845a741399ca9b5b4739a11926dd4
Score
10/10
Malware Config
Signatures
- Family: Remcos
Remcos is a closed-source remote control and surveillance software.
- Suricata alert: REMCOS RAT Malware Inbound C2 Communication 4 IoCs
Network activity triggered a Suricata alert
- Suricata alert: REMCOS RAT Malware Outbound C2 Communication 7 IoCs
Network activity triggered a Suricata alert
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of FindShellTrayWindow 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\729d34221798360fcb7d79665392972be70845a741399ca9b5b4739a11926dd4.exe"C:\Users\Admin\AppData\Local\Temp\729d34221798360fcb7d79665392972be70845a741399ca9b5b4739a11926dd4.exe"1⤵
- Suricata alert: REMCOS RAT Malware Inbound C2 Communication
- Suricata alert: REMCOS RAT Malware Outbound C2 Communication
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
-