Analysis
- user interaction
yes - max time kernel
148s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
27/10/2026, 03:16
Behavioral task
behavioral1
Sample
f.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
f.exe
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
f.exe
Resource
win11-20260911-en
windows11-21h2-x64
6 signatures
150 seconds
General
- Target f.exe
- Size 644KB
- Sample261027-dszvfaas2x
- SHA256 34ee4cc0e355237841e6c0baaddcbd62aeff4f30268c3e8b66922c8a66fe8291
- MD5 f112cd752e7338a3b96ed78d3cf199e1
- SHA1 6aa4f0ebd1b69794b2ca3b797da3ea73ebba3691
- SHA512 274ca51d2e9a9d5b8b6b9ae090802effbedb82270da3db272f33a684f655ba39b4257739dc95ad04a76bd795e56e90ea4350f06c5c704f7e6004aa18c90129d0
- SSDEEP 12288:5IfxS5XkH4nOqwitNfuquCwgs69gy3V5v+BNyo3PoL5aDz:e5GXkH4nnwitNfuq9wgs3y3V5vgNyo3E
- TLSH T13FE46D59A39402F8D0B7C135C982953BE7B2BC065571472F03E70E9B2F276A16F3AB16
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Suricata alert: REMCOS RAT Malware Outbound C2 Communication 64 IoCs
Network activity triggered a Suricata alert
flow pid Process 78 2588 f.exe 78 2588 f.exe 117 2588 f.exe 117 2588 f.exe 164 2588 f.exe 164 2588 f.exe 154 2588 f.exe 154 2588 f.exe 155 2588 f.exe 155 2588 f.exe 75 2588 f.exe 75 2588 f.exe 83 2588 f.exe 83 2588 f.exe 91 2588 f.exe 91 2588 f.exe 110 2588 f.exe 110 2588 f.exe 138 2588 f.exe 138 2588 f.exe 152 2588 f.exe 152 2588 f.exe 182 2588 f.exe 182 2588 f.exe 4 2588 f.exe 4 2588 f.exe 51 2588 f.exe 51 2588 f.exe 88 2588 f.exe 88 2588 f.exe 106 2588 f.exe 106 2588 f.exe 175 2588 f.exe 175 2588 f.exe 81 2588 f.exe 81 2588 f.exe 148 2588 f.exe 148 2588 f.exe 37 2588 f.exe 37 2588 f.exe 49 2588 f.exe 49 2588 f.exe 85 2588 f.exe 85 2588 f.exe 86 2588 f.exe 86 2588 f.exe 109 2588 f.exe 109 2588 f.exe 105 2588 f.exe 105 2588 f.exe 177 2588 f.exe 177 2588 f.exe 181 2588 f.exe 181 2588 f.exe 168 2588 f.exe 168 2588 f.exe 157 2588 f.exe 157 2588 f.exe 160 2588 f.exe 160 2588 f.exe 9 2588 f.exe 9 2588 f.exe 53 2588 f.exe 53 2588 f.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain f.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname f.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2588 f.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2588 f.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2588 f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f.exe"C:\Users\Admin\AppData\Local\Temp\f.exe"1⤵
- Suricata alert: REMCOS RAT Malware Outbound C2 Communication
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2588