Analysis
- max time kernel
149s - max time network
149s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260911-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
27/10/2026, 03:16
Behavioral task
behavioral1
Sample
f.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
f.exe
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
f.exe
Resource
win11-20260911-en
windows11-21h2-x64
6 signatures
150 seconds
General
- Target f.exe
- Size 644KB
- Sample261027-dszvfaas2x
- SHA256 34ee4cc0e355237841e6c0baaddcbd62aeff4f30268c3e8b66922c8a66fe8291
- MD5 f112cd752e7338a3b96ed78d3cf199e1
- SHA1 6aa4f0ebd1b69794b2ca3b797da3ea73ebba3691
- SHA512 274ca51d2e9a9d5b8b6b9ae090802effbedb82270da3db272f33a684f655ba39b4257739dc95ad04a76bd795e56e90ea4350f06c5c704f7e6004aa18c90129d0
- SSDEEP 12288:5IfxS5XkH4nOqwitNfuquCwgs69gy3V5v+BNyo3PoL5aDz:e5GXkH4nnwitNfuq9wgs3y3V5vgNyo3E
- TLSH T13FE46D59A39402F8D0B7C135C982953BE7B2BC065571472F03E70E9B2F276A16F3AB16
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Suricata alert: REMCOS RAT Malware Outbound C2 Communication 64 IoCs
Network activity triggered a Suricata alert
flow pid Process 138 1084 f.exe 138 1084 f.exe 173 1084 f.exe 173 1084 f.exe 174 1084 f.exe 174 1084 f.exe 100 1084 f.exe 100 1084 f.exe 52 1084 f.exe 52 1084 f.exe 150 1084 f.exe 150 1084 f.exe 151 1084 f.exe 151 1084 f.exe 29 1084 f.exe 29 1084 f.exe 57 1084 f.exe 57 1084 f.exe 77 1084 f.exe 77 1084 f.exe 35 1084 f.exe 35 1084 f.exe 156 1084 f.exe 156 1084 f.exe 154 1084 f.exe 154 1084 f.exe 163 1084 f.exe 163 1084 f.exe 93 1084 f.exe 93 1084 f.exe 165 1084 f.exe 165 1084 f.exe 21 1084 f.exe 21 1084 f.exe 88 1084 f.exe 88 1084 f.exe 85 1084 f.exe 85 1084 f.exe 142 1084 f.exe 142 1084 f.exe 19 1084 f.exe 19 1084 f.exe 72 1084 f.exe 72 1084 f.exe 107 1084 f.exe 107 1084 f.exe 144 1084 f.exe 144 1084 f.exe 143 1084 f.exe 143 1084 f.exe 31 1084 f.exe 31 1084 f.exe 159 1084 f.exe 159 1084 f.exe 116 1084 f.exe 116 1084 f.exe 47 1084 f.exe 47 1084 f.exe 51 1084 f.exe 51 1084 f.exe 130 1084 f.exe 130 1084 f.exe 172 1084 f.exe 172 1084 f.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname f.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain f.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1084 f.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1084 f.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 1084 f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f.exe"C:\Users\Admin\AppData\Local\Temp\f.exe"1⤵
- Suricata alert: REMCOS RAT Malware Outbound C2 Communication
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1084