Analysis
- max time kernel
150s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/10/2026, 12:56
Behavioral task
behavioral1
Sample
S8_App.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target S8_App.exe
- Size 525KB
- Sample261003-p6ebfazzbx
- SHA256 8a081cf263c82f3d4523d71b69ee1bbe7c8ba3d34c2be510392141ef1852ff13
- MD5 91596b86c3440661ad90a9564d356f7f
- SHA1 206b7c5217d7656056b82d2c209a8b887ac3ab8e
- SHA512 2e1f6c49df9220252ef55f71f46adcbdf09ff072e7952cc784c293cfb1ccabb1713c493aa13ea9f61513949d642cbfcf1e2626f19e035e75572d7e5e2c118f37
- SSDEEP 12288:VcF3UU0AViEhkwkhoo+/TUszmXxr1svZ9sxt:x1AViE/kHszmXWZ+
- TLSH T1C4B4AE01BAF1C1B2D57664700939EB35CEBCBC211C359D2B63D61E9ABE301519B3AB72
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Suricata alert: REMCOS RAT Malware Outbound C2 Communication 64 IoCs
Network activity triggered a Suricata alert
flow pid Process 336 5136 S8_App.exe 336 5136 S8_App.exe 124 5136 S8_App.exe 124 5136 S8_App.exe 171 5136 S8_App.exe 171 5136 S8_App.exe 190 5136 S8_App.exe 190 5136 S8_App.exe 33 5136 S8_App.exe 33 5136 S8_App.exe 110 5136 S8_App.exe 110 5136 S8_App.exe 331 5136 S8_App.exe 331 5136 S8_App.exe 12 5136 S8_App.exe 12 5136 S8_App.exe 49 5136 S8_App.exe 49 5136 S8_App.exe 135 5136 S8_App.exe 135 5136 S8_App.exe 197 5136 S8_App.exe 197 5136 S8_App.exe 234 5136 S8_App.exe 234 5136 S8_App.exe 254 5136 S8_App.exe 254 5136 S8_App.exe 137 5136 S8_App.exe 137 5136 S8_App.exe 366 5136 S8_App.exe 366 5136 S8_App.exe 87 5136 S8_App.exe 87 5136 S8_App.exe 63 5136 S8_App.exe 63 5136 S8_App.exe 149 5136 S8_App.exe 149 5136 S8_App.exe 206 5136 S8_App.exe 206 5136 S8_App.exe 355 5136 S8_App.exe 355 5136 S8_App.exe 280 5136 S8_App.exe 280 5136 S8_App.exe 338 5136 S8_App.exe 338 5136 S8_App.exe 121 5136 S8_App.exe 121 5136 S8_App.exe 184 5136 S8_App.exe 184 5136 S8_App.exe 165 5136 S8_App.exe 165 5136 S8_App.exe 136 5136 S8_App.exe 136 5136 S8_App.exe 157 5136 S8_App.exe 157 5136 S8_App.exe 128 5136 S8_App.exe 128 5136 S8_App.exe 325 5136 S8_App.exe 325 5136 S8_App.exe 379 5136 S8_App.exe 379 5136 S8_App.exe 64 5136 S8_App.exe 64 5136 S8_App.exe 80 5136 S8_App.exe 80 5136 S8_App.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname S8_App.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain S8_App.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language S8_App.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5136 S8_App.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5136 S8_App.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 5136 S8_App.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\S8_App.exe"C:\Users\Admin\AppData\Local\Temp\S8_App.exe"1⤵
- Suricata alert: REMCOS RAT Malware Outbound C2 Communication
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5136