Analysis
- max time kernel
900s - max time network
901s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/10/2026, 04:30
Behavioral task
behavioral1
Sample
T7.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
15 signatures
900 seconds
Behavioral task
behavioral2
Sample
T7.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
14 signatures
900 seconds
General
- Target T7.exe
- Size 645KB
- Sample261008-e4y8qaay4v
- SHA256 2e78ddc4b42fbc25184ae0b5818f26488f3e7364911ab1690d1c5f29497cda0c
- MD5 185f312df15e90b720bbb943559cc2a2
- SHA1 4d38c336c99ea72a194c9ef8e95ba6ebdb318064
- SHA512 cc7d44dc86e81983f8a6827a177e8c13b61499d38b4a439f946e08c01a428f298cacf3810161fe8f3830be2e617db2954520ecc341fd8153e17631a6a5f27be5
- SSDEEP 12288:RIfxS5XkH4nOqwitNfuquCwgs69gy3V5v+BNyo3PoL5aDz:25GXkH4nnwitNfuq9wgs3y3V5vgNyo3E
- TLSH T179E46D59A39402F8D0B7C135C982952BE7B2BC065571472F03D70E9B2F276A16F3EB26
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
remcos
Version
-
7.3.1 Pro
Botnet
-
RemoteHost
C2
-
g-luck8888.com:443
-
g-luck8888.com:8080
-
g-luck8888.com:80
-
www.g-luck8888.com:443
-
www.g-luck8888.com:8080
-
www.g-luck8888.com:80
Attributes
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
hidd3ng3m.exe
-
copy_folder
hidd3ng3m
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
true
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
hidd3ng3m-FIUGTA
-
screenshot_crypt
false
-
screenshot_flag
true
-
screenshot_folder
Screenshots
-
screenshot_path
%WinDir%\System32
-
screenshot_time
10
- startup_value
-
take_screenshot_option
true
-
take_screenshot_time
5
-
take_screenshot_title
chrome;telegram;messenger;facebook
Signatures
- Suricata alert: REMCOS RAT Malware Outbound C2 Communication 64 IoCs
Network activity triggered a Suricata alert
flow pid Process 37 5020 hidd3ng3m.exe 37 5020 hidd3ng3m.exe 39 5020 hidd3ng3m.exe 39 5020 hidd3ng3m.exe 90 5020 hidd3ng3m.exe 90 5020 hidd3ng3m.exe 148 5020 hidd3ng3m.exe 148 5020 hidd3ng3m.exe 66 5020 hidd3ng3m.exe 66 5020 hidd3ng3m.exe 43 5020 hidd3ng3m.exe 43 5020 hidd3ng3m.exe 118 5020 hidd3ng3m.exe 118 5020 hidd3ng3m.exe 134 5020 hidd3ng3m.exe 134 5020 hidd3ng3m.exe 6 5020 hidd3ng3m.exe 6 5020 hidd3ng3m.exe 92 5020 hidd3ng3m.exe 92 5020 hidd3ng3m.exe 41 5020 hidd3ng3m.exe 41 5020 hidd3ng3m.exe 86 5020 hidd3ng3m.exe 86 5020 hidd3ng3m.exe 142 5020 hidd3ng3m.exe 142 5020 hidd3ng3m.exe 151 5020 hidd3ng3m.exe 151 5020 hidd3ng3m.exe 94 5020 hidd3ng3m.exe 94 5020 hidd3ng3m.exe 115 5020 hidd3ng3m.exe 115 5020 hidd3ng3m.exe 101 5020 hidd3ng3m.exe 101 5020 hidd3ng3m.exe 110 5020 hidd3ng3m.exe 110 5020 hidd3ng3m.exe 26 5020 hidd3ng3m.exe 26 5020 hidd3ng3m.exe 48 5020 hidd3ng3m.exe 48 5020 hidd3ng3m.exe 33 5020 hidd3ng3m.exe 33 5020 hidd3ng3m.exe 98 5020 hidd3ng3m.exe 98 5020 hidd3ng3m.exe 103 5020 hidd3ng3m.exe 103 5020 hidd3ng3m.exe 64 5020 hidd3ng3m.exe 64 5020 hidd3ng3m.exe 116 5020 hidd3ng3m.exe 116 5020 hidd3ng3m.exe 141 5020 hidd3ng3m.exe 141 5020 hidd3ng3m.exe 13 5020 hidd3ng3m.exe 13 5020 hidd3ng3m.exe 25 5020 hidd3ng3m.exe 25 5020 hidd3ng3m.exe 63 5020 hidd3ng3m.exe 63 5020 hidd3ng3m.exe 129 5020 hidd3ng3m.exe 129 5020 hidd3ng3m.exe 137 5020 hidd3ng3m.exe 137 5020 hidd3ng3m.exe 97 5020 hidd3ng3m.exe 97 5020 hidd3ng3m.exe - Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ hidd3ng3m.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hidd3ng3m-FIUGTA = "\"C:\\ProgramData\\hidd3ng3m\\hidd3ng3m.exe\"" hidd3ng3m.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ T7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hidd3ng3m-FIUGTA = "\"C:\\ProgramData\\hidd3ng3m\\hidd3ng3m.exe\"" T7.exe - Executes dropped EXE 1 IoCs
pid Process 5020 hidd3ng3m.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\hidd3ng3m-FIUGTA = "\"C:\\ProgramData\\hidd3ng3m\\hidd3ng3m.exe\"" hidd3ng3m.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hidd3ng3m-FIUGTA = "\"C:\\ProgramData\\hidd3ng3m\\hidd3ng3m.exe\"" hidd3ng3m.exe Set value (str) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\hidd3ng3m-FIUGTA = "\"C:\\ProgramData\\hidd3ng3m\\hidd3ng3m.exe\"" T7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hidd3ng3m-FIUGTA = "\"C:\\ProgramData\\hidd3ng3m\\hidd3ng3m.exe\"" T7.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Screenshots\time_20261008_043039.jpg hidd3ng3m.exe File created C:\Windows\SysWOW64\Screenshots\time_20261008_044040.jpg hidd3ng3m.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname hidd3ng3m.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain hidd3ng3m.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5020 hidd3ng3m.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 552 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 552 AUDIODG.EXE - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5020 hidd3ng3m.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 5020 hidd3ng3m.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5020 hidd3ng3m.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4416 wrote to memory of 5020 4416 T7.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\T7.exe"C:\Users\Admin\AppData\Local\Temp\T7.exe"1⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\ProgramData\hidd3ng3m\hidd3ng3m.exe"C:\ProgramData\hidd3ng3m\hidd3ng3m.exe"2⤵
- Suricata alert: REMCOS RAT Malware Outbound C2 Communication
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5020
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004FC 0x00000000000005041⤵
- Suspicious use of AdjustPrivilegeToken
PID:552
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:4936
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵PID:4504
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\hidd3ng3m\hidd3ng3m.exe
- Size 645KB
- SHA256 2e78ddc4b42fbc25184ae0b5818f26488f3e7364911ab1690d1c5f29497cda0c
- MD5 185f312df15e90b720bbb943559cc2a2
- SHA1 4d38c336c99ea72a194c9ef8e95ba6ebdb318064
- SHA512 cc7d44dc86e81983f8a6827a177e8c13b61499d38b4a439f946e08c01a428f298cacf3810161fe8f3830be2e617db2954520ecc341fd8153e17631a6a5f27be5
- SSDEEP 12288:RIfxS5XkH4nOqwitNfuquCwgs69gy3V5v+BNyo3PoL5aDz:25GXkH4nnwitNfuq9wgs3y3V5vgNyo3E
- TLSH T179E46D59A39402F8D0B7C135C982952BE7B2BC065571472F03D70E9B2F276A16F3EB26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\remcos\logs.dat
- Size 230B
- SHA256 124e512261ccd855c58db87f42ca612df2ee59446d224ad598aa472b52bcde31
- MD5 c06d6fe9284627488a48ad224d9181da
- SHA1 86bc011ed6dd3d2feaa72ff4cef1a5f06263d3dd
- SHA512 cde08832e9981f4e8ae7185295685af63c45904f19f22999acaf48d333f43c42a5bfc57755c9f30e2d8f2a6b0e91eabded33d53cacd1b00cdaf8f4775831e912
- TLSH T129D0C91627F600AABAA3919A95F700272AB6F96A0238CD1D1AD0834D3CB6B016602773
- MD5 SHA1 SHA512 TLSH