Analysis
- max time kernel
60s - max time network
57s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
19/10/2026, 20:01
Behavioral task
behavioral1
Sample
9956faa29f7a27c62dcd3dead29ae8b93ab2a9bbe9ce0cf85fae4b83f0c3afc9.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
60 seconds
General
- Target 9956faa29f7a27c62dcd3dead29ae8b93ab2a9bbe9ce0cf85fae4b83f0c3afc9.exe
- Size 644KB
- Sample261019-yrmtpszzds
- SHA256 9956faa29f7a27c62dcd3dead29ae8b93ab2a9bbe9ce0cf85fae4b83f0c3afc9
- MD5 755e3bf7f56d8f27ef041acc1aed450d
- SHA1 29c74c05c2a24aa822059c002ee5f2e1a196e986
- SHA512 a04882f16301f52d854209f55305439ead4baf4f62524cb26901489ebefdf5f16f2e02b8d74c9428824d4e4273d93ffcf7b148162d51b538b70c08087628f917
- SSDEEP 12288:hIfxS5XkH4nOqwitNfuquCwgs69gy3V5v+BNyo3PoL5aDz:m5GXkH4nnwitNfuq9wgs3y3V5vgNyo3E
- TLSH T1C9E46D59A39402F8D0B7C135C982952BE7B27C065571472F03E70E9B2F277A16F3AB26
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Suricata alert: REMCOS RAT Malware Outbound C2 Communication 64 IoCs
Network activity triggered a Suricata alert
flow pid Process 11 4092 9956faa29f7a27c62dcd3dead29ae8b93ab2a9bbe9ce0cf85fae4b83f0c3afc9.exe 11 4092 9956faa29f7a27c62dcd3dead29ae8b93ab2a9bbe9ce0cf85fae4b83f0c3afc9.exe 32 4092 9956faa29f7a27c62dcd3dead29ae8b93ab2a9bbe9ce0cf85fae4b83f0c3afc9.exe 32 4092 9956faa29f7a27c62dcd3dead29ae8b93ab2a9bbe9ce0cf85fae4b83f0c3afc9.exe 29 4092 9956faa29f7a27c62dcd3dead29ae8b93ab2a9bbe9ce0cf85fae4b83f0c3afc9.exe 29 4092 9956faa29f7a27c62dcd3dead29ae8b93ab2a9bbe9ce0cf85fae4b83f0c3afc9.exe 36 4092 9956faa29f7a27c62dcd3dead29ae8b93ab2a9bbe9ce0cf85fae4b83f0c3afc9.exe 36 4092 9956faa29f7a27c62dcd3dead29ae8b93ab2a9bbe9ce0cf85fae4b83f0c3afc9.exe 9 4092 9956faa29f7a27c62dcd3dead29ae8b93ab2a9bbe9ce0cf85fae4b83f0c3afc9.exe 9 4092 9956faa29f7a27c62dcd3dead29ae8b93ab2a9bbe9ce0cf85fae4b83f0c3afc9.exe 24 4092 9956faa29f7a27c62dcd3dead29ae8b93ab2a9bbe9ce0cf85fae4b83f0c3afc9.exe 24 4092 9956faa29f7a27c62dcd3dead29ae8b93ab2a9bbe9ce0cf85fae4b83f0c3afc9.exe 23 4092 9956faa29f7a27c62dcd3dead29ae8b93ab2a9bbe9ce0cf85fae4b83f0c3afc9.exe 23 4092 9956faa29f7a27c62dcd3dead29ae8b93ab2a9bbe9ce0cf85fae4b83f0c3afc9.exe 35 4092 9956faa29f7a27c62dcd3dead29ae8b93ab2a9bbe9ce0cf85fae4b83f0c3afc9.exe 35 4092 9956faa29f7a27c62dcd3dead29ae8b93ab2a9bbe9ce0cf85fae4b83f0c3afc9.exe 39 4092 9956faa29f7a27c62dcd3dead29ae8b93ab2a9bbe9ce0cf85fae4b83f0c3afc9.exe 39 4092 9956faa29f7a27c62dcd3dead29ae8b93ab2a9bbe9ce0cf85fae4b83f0c3afc9.exe 26 4092 9956faa29f7a27c62dcd3dead29ae8b93ab2a9bbe9ce0cf85fae4b83f0c3afc9.exe 26 4092 9956faa29f7a27c62dcd3dead29ae8b93ab2a9bbe9ce0cf85fae4b83f0c3afc9.exe 34 4092 9956faa29f7a27c62dcd3dead29ae8b93ab2a9bbe9ce0cf85fae4b83f0c3afc9.exe 34 4092 9956faa29f7a27c62dcd3dead29ae8b93ab2a9bbe9ce0cf85fae4b83f0c3afc9.exe 15 4092 9956faa29f7a27c62dcd3dead29ae8b93ab2a9bbe9ce0cf85fae4b83f0c3afc9.exe 15 4092 9956faa29f7a27c62dcd3dead29ae8b93ab2a9bbe9ce0cf85fae4b83f0c3afc9.exe 31 4092 9956faa29f7a27c62dcd3dead29ae8b93ab2a9bbe9ce0cf85fae4b83f0c3afc9.exe 31 4092 9956faa29f7a27c62dcd3dead29ae8b93ab2a9bbe9ce0cf85fae4b83f0c3afc9.exe 45 4092 9956faa29f7a27c62dcd3dead29ae8b93ab2a9bbe9ce0cf85fae4b83f0c3afc9.exe 45 4092 9956faa29f7a27c62dcd3dead29ae8b93ab2a9bbe9ce0cf85fae4b83f0c3afc9.exe 44 4092 9956faa29f7a27c62dcd3dead29ae8b93ab2a9bbe9ce0cf85fae4b83f0c3afc9.exe 44 4092 9956faa29f7a27c62dcd3dead29ae8b93ab2a9bbe9ce0cf85fae4b83f0c3afc9.exe 14 4092 9956faa29f7a27c62dcd3dead29ae8b93ab2a9bbe9ce0cf85fae4b83f0c3afc9.exe 14 4092 9956faa29f7a27c62dcd3dead29ae8b93ab2a9bbe9ce0cf85fae4b83f0c3afc9.exe 17 4092 9956faa29f7a27c62dcd3dead29ae8b93ab2a9bbe9ce0cf85fae4b83f0c3afc9.exe 17 4092 9956faa29f7a27c62dcd3dead29ae8b93ab2a9bbe9ce0cf85fae4b83f0c3afc9.exe 25 4092 9956faa29f7a27c62dcd3dead29ae8b93ab2a9bbe9ce0cf85fae4b83f0c3afc9.exe 25 4092 9956faa29f7a27c62dcd3dead29ae8b93ab2a9bbe9ce0cf85fae4b83f0c3afc9.exe 42 4092 9956faa29f7a27c62dcd3dead29ae8b93ab2a9bbe9ce0cf85fae4b83f0c3afc9.exe 42 4092 9956faa29f7a27c62dcd3dead29ae8b93ab2a9bbe9ce0cf85fae4b83f0c3afc9.exe 21 4092 9956faa29f7a27c62dcd3dead29ae8b93ab2a9bbe9ce0cf85fae4b83f0c3afc9.exe 21 4092 9956faa29f7a27c62dcd3dead29ae8b93ab2a9bbe9ce0cf85fae4b83f0c3afc9.exe 27 4092 9956faa29f7a27c62dcd3dead29ae8b93ab2a9bbe9ce0cf85fae4b83f0c3afc9.exe 27 4092 9956faa29f7a27c62dcd3dead29ae8b93ab2a9bbe9ce0cf85fae4b83f0c3afc9.exe 40 4092 9956faa29f7a27c62dcd3dead29ae8b93ab2a9bbe9ce0cf85fae4b83f0c3afc9.exe 40 4092 9956faa29f7a27c62dcd3dead29ae8b93ab2a9bbe9ce0cf85fae4b83f0c3afc9.exe 41 4092 9956faa29f7a27c62dcd3dead29ae8b93ab2a9bbe9ce0cf85fae4b83f0c3afc9.exe 41 4092 9956faa29f7a27c62dcd3dead29ae8b93ab2a9bbe9ce0cf85fae4b83f0c3afc9.exe 16 4092 9956faa29f7a27c62dcd3dead29ae8b93ab2a9bbe9ce0cf85fae4b83f0c3afc9.exe 16 4092 9956faa29f7a27c62dcd3dead29ae8b93ab2a9bbe9ce0cf85fae4b83f0c3afc9.exe 20 4092 9956faa29f7a27c62dcd3dead29ae8b93ab2a9bbe9ce0cf85fae4b83f0c3afc9.exe 20 4092 9956faa29f7a27c62dcd3dead29ae8b93ab2a9bbe9ce0cf85fae4b83f0c3afc9.exe 43 4092 9956faa29f7a27c62dcd3dead29ae8b93ab2a9bbe9ce0cf85fae4b83f0c3afc9.exe 43 4092 9956faa29f7a27c62dcd3dead29ae8b93ab2a9bbe9ce0cf85fae4b83f0c3afc9.exe 19 4092 9956faa29f7a27c62dcd3dead29ae8b93ab2a9bbe9ce0cf85fae4b83f0c3afc9.exe 19 4092 9956faa29f7a27c62dcd3dead29ae8b93ab2a9bbe9ce0cf85fae4b83f0c3afc9.exe 13 4092 9956faa29f7a27c62dcd3dead29ae8b93ab2a9bbe9ce0cf85fae4b83f0c3afc9.exe 13 4092 9956faa29f7a27c62dcd3dead29ae8b93ab2a9bbe9ce0cf85fae4b83f0c3afc9.exe 22 4092 9956faa29f7a27c62dcd3dead29ae8b93ab2a9bbe9ce0cf85fae4b83f0c3afc9.exe 22 4092 9956faa29f7a27c62dcd3dead29ae8b93ab2a9bbe9ce0cf85fae4b83f0c3afc9.exe 12 4092 9956faa29f7a27c62dcd3dead29ae8b93ab2a9bbe9ce0cf85fae4b83f0c3afc9.exe 12 4092 9956faa29f7a27c62dcd3dead29ae8b93ab2a9bbe9ce0cf85fae4b83f0c3afc9.exe 30 4092 9956faa29f7a27c62dcd3dead29ae8b93ab2a9bbe9ce0cf85fae4b83f0c3afc9.exe 30 4092 9956faa29f7a27c62dcd3dead29ae8b93ab2a9bbe9ce0cf85fae4b83f0c3afc9.exe 33 4092 9956faa29f7a27c62dcd3dead29ae8b93ab2a9bbe9ce0cf85fae4b83f0c3afc9.exe 33 4092 9956faa29f7a27c62dcd3dead29ae8b93ab2a9bbe9ce0cf85fae4b83f0c3afc9.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 9956faa29f7a27c62dcd3dead29ae8b93ab2a9bbe9ce0cf85fae4b83f0c3afc9.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 9956faa29f7a27c62dcd3dead29ae8b93ab2a9bbe9ce0cf85fae4b83f0c3afc9.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4092 9956faa29f7a27c62dcd3dead29ae8b93ab2a9bbe9ce0cf85fae4b83f0c3afc9.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 4092 9956faa29f7a27c62dcd3dead29ae8b93ab2a9bbe9ce0cf85fae4b83f0c3afc9.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9956faa29f7a27c62dcd3dead29ae8b93ab2a9bbe9ce0cf85fae4b83f0c3afc9.exe"C:\Users\Admin\AppData\Local\Temp\9956faa29f7a27c62dcd3dead29ae8b93ab2a9bbe9ce0cf85fae4b83f0c3afc9.exe"1⤵
- Suricata alert: REMCOS RAT Malware Outbound C2 Communication
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4092