Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
03/10/2026, 12:56
Behavioral task
behavioral1
Sample
S8_App.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target S8_App.exe
- Size 525KB
- Sample261003-p6ebfazzbx
- SHA256 8a081cf263c82f3d4523d71b69ee1bbe7c8ba3d34c2be510392141ef1852ff13
- MD5 91596b86c3440661ad90a9564d356f7f
- SHA1 206b7c5217d7656056b82d2c209a8b887ac3ab8e
- SHA512 2e1f6c49df9220252ef55f71f46adcbdf09ff072e7952cc784c293cfb1ccabb1713c493aa13ea9f61513949d642cbfcf1e2626f19e035e75572d7e5e2c118f37
- SSDEEP 12288:VcF3UU0AViEhkwkhoo+/TUszmXxr1svZ9sxt:x1AViE/kHszmXWZ+
- TLSH T1C4B4AE01BAF1C1B2D57664700939EB35CEBCBC211C359D2B63D61E9ABE301519B3AB72
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Suricata alert: REMCOS RAT Malware Outbound C2 Communication 64 IoCs
Network activity triggered a Suricata alert
flow pid Process 325 5308 S8_App.exe 325 5308 S8_App.exe 313 5308 S8_App.exe 313 5308 S8_App.exe 339 5308 S8_App.exe 339 5308 S8_App.exe 390 5308 S8_App.exe 390 5308 S8_App.exe 145 5308 S8_App.exe 145 5308 S8_App.exe 207 5308 S8_App.exe 207 5308 S8_App.exe 284 5308 S8_App.exe 284 5308 S8_App.exe 404 5308 S8_App.exe 404 5308 S8_App.exe 505 5308 S8_App.exe 505 5308 S8_App.exe 460 5308 S8_App.exe 460 5308 S8_App.exe 524 5308 S8_App.exe 524 5308 S8_App.exe 508 5308 S8_App.exe 508 5308 S8_App.exe 94 5308 S8_App.exe 94 5308 S8_App.exe 337 5308 S8_App.exe 337 5308 S8_App.exe 356 5308 S8_App.exe 356 5308 S8_App.exe 478 5308 S8_App.exe 478 5308 S8_App.exe 244 5308 S8_App.exe 244 5308 S8_App.exe 497 5308 S8_App.exe 497 5308 S8_App.exe 476 5308 S8_App.exe 476 5308 S8_App.exe 52 5308 S8_App.exe 52 5308 S8_App.exe 132 5308 S8_App.exe 132 5308 S8_App.exe 79 5308 S8_App.exe 79 5308 S8_App.exe 413 5308 S8_App.exe 413 5308 S8_App.exe 471 5308 S8_App.exe 471 5308 S8_App.exe 457 5308 S8_App.exe 457 5308 S8_App.exe 490 5308 S8_App.exe 490 5308 S8_App.exe 389 5308 S8_App.exe 389 5308 S8_App.exe 49 5308 S8_App.exe 49 5308 S8_App.exe 235 5308 S8_App.exe 235 5308 S8_App.exe 260 5308 S8_App.exe 260 5308 S8_App.exe 274 5308 S8_App.exe 274 5308 S8_App.exe 509 5308 S8_App.exe 509 5308 S8_App.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain S8_App.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname S8_App.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language S8_App.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5308 S8_App.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5308 S8_App.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 5308 S8_App.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\S8_App.exe"C:\Users\Admin\AppData\Local\Temp\S8_App.exe"1⤵
- Suricata alert: REMCOS RAT Malware Outbound C2 Communication
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5308