Analysis
- user interaction
yes - max time kernel
117s - max time network
121s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260911-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
02/10/2026, 16:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
REIMANOS.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
REIMANOS.exe
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
6 signatures
150 seconds
General
- Target REIMANOS.exe
- Size 26.4MB
- Sample261002-tg7c5sdf49
- SHA256 49f1aed137ecda7eb168253f31e87f36c898728a738e6c3dcc5dd9e92d708ac7
- MD5 f51a243f3e73a1be453ebf78e92b616a
- SHA1 df9f99d0ec5d8749953b1fdfba901f941e914841
- SHA512 34ee2d52e14df9498cc50bc109c55645e7073a345e8ced6249e811ccf4de9ba47e4a8400611826a7ba78f2b9e66b2c1c807cdefab356895a22b85cd6b44a9cd1
- SSDEEP 393216:dL2tg8rRW99rmiVeegB2mKK9T54dcSG4F4N6DdvhN/i18EczA7nfoPDpwQSpQoBg:szBedclNJNfSpzAPXw
- TLSH T16C570243A2C64756DF92B93DA1129323E1A2FCD6231186C36F9D0F1ADB17AF0497DB18
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe - Suspicious behavior: EnumeratesProcesses 15 IoCs
pid Process 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 228 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 228 taskmgr.exe Token: SeSystemProfilePrivilege 228 taskmgr.exe Token: SeCreateGlobalPrivilege 228 taskmgr.exe Token: 33 228 taskmgr.exe Token: SeIncBasePriorityPrivilege 228 taskmgr.exe - Suspicious use of FindShellTrayWindow 35 IoCs
pid Process 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe - Suspicious use of SendNotifyMessage 35 IoCs
pid Process 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe 228 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\REIMANOS.exe"C:\Users\Admin\AppData\Local\Temp\REIMANOS.exe"1⤵PID:4900
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:228