Analysis
- max time kernel
149s - max time network
148s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
27/10/2026, 03:16
Behavioral task
behavioral1
Sample
f.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
f.exe
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
f.exe
Resource
win11-20260911-en
windows11-21h2-x64
6 signatures
150 seconds
General
- Target f.exe
- Size 644KB
- Sample261027-dszvfaas2x
- SHA256 34ee4cc0e355237841e6c0baaddcbd62aeff4f30268c3e8b66922c8a66fe8291
- MD5 f112cd752e7338a3b96ed78d3cf199e1
- SHA1 6aa4f0ebd1b69794b2ca3b797da3ea73ebba3691
- SHA512 274ca51d2e9a9d5b8b6b9ae090802effbedb82270da3db272f33a684f655ba39b4257739dc95ad04a76bd795e56e90ea4350f06c5c704f7e6004aa18c90129d0
- SSDEEP 12288:5IfxS5XkH4nOqwitNfuquCwgs69gy3V5v+BNyo3PoL5aDz:e5GXkH4nnwitNfuq9wgs3y3V5vgNyo3E
- TLSH T13FE46D59A39402F8D0B7C135C982953BE7B2BC065571472F03E70E9B2F276A16F3AB16
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Suricata alert: REMCOS RAT Malware Outbound C2 Communication 64 IoCs
Network activity triggered a Suricata alert
flow pid Process 22 2772 f.exe 22 2772 f.exe 59 2772 f.exe 59 2772 f.exe 40 2772 f.exe 40 2772 f.exe 80 2772 f.exe 80 2772 f.exe 7 2772 f.exe 7 2772 f.exe 25 2772 f.exe 25 2772 f.exe 17 2772 f.exe 17 2772 f.exe 56 2772 f.exe 56 2772 f.exe 89 2772 f.exe 89 2772 f.exe 111 2772 f.exe 111 2772 f.exe 120 2772 f.exe 120 2772 f.exe 28 2772 f.exe 28 2772 f.exe 101 2772 f.exe 101 2772 f.exe 109 2772 f.exe 109 2772 f.exe 116 2772 f.exe 116 2772 f.exe 45 2772 f.exe 45 2772 f.exe 86 2772 f.exe 86 2772 f.exe 105 2772 f.exe 105 2772 f.exe 20 2772 f.exe 20 2772 f.exe 92 2772 f.exe 92 2772 f.exe 118 2772 f.exe 118 2772 f.exe 85 2772 f.exe 85 2772 f.exe 14 2772 f.exe 14 2772 f.exe 26 2772 f.exe 26 2772 f.exe 49 2772 f.exe 49 2772 f.exe 67 2772 f.exe 67 2772 f.exe 96 2772 f.exe 96 2772 f.exe 4 2772 f.exe 4 2772 f.exe 11 2772 f.exe 11 2772 f.exe 42 2772 f.exe 42 2772 f.exe 37 2772 f.exe 37 2772 f.exe 121 2772 f.exe 121 2772 f.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname f.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain f.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2772 f.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2772 f.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2772 f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f.exe"C:\Users\Admin\AppData\Local\Temp\f.exe"1⤵
- Suricata alert: REMCOS RAT Malware Outbound C2 Communication
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2772