Analysis
- max time kernel
149s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/10/2026, 03:16
Behavioral task
behavioral1
Sample
f.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
f.exe
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
f.exe
Resource
win11-20260911-en
windows11-21h2-x64
6 signatures
150 seconds
General
- Target f.exe
- Size 644KB
- Sample261027-dszvfaas2x
- SHA256 34ee4cc0e355237841e6c0baaddcbd62aeff4f30268c3e8b66922c8a66fe8291
- MD5 f112cd752e7338a3b96ed78d3cf199e1
- SHA1 6aa4f0ebd1b69794b2ca3b797da3ea73ebba3691
- SHA512 274ca51d2e9a9d5b8b6b9ae090802effbedb82270da3db272f33a684f655ba39b4257739dc95ad04a76bd795e56e90ea4350f06c5c704f7e6004aa18c90129d0
- SSDEEP 12288:5IfxS5XkH4nOqwitNfuquCwgs69gy3V5v+BNyo3PoL5aDz:e5GXkH4nnwitNfuq9wgs3y3V5vgNyo3E
- TLSH T13FE46D59A39402F8D0B7C135C982953BE7B2BC065571472F03E70E9B2F276A16F3AB16
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Suricata alert: REMCOS RAT Malware Outbound C2 Communication 64 IoCs
Network activity triggered a Suricata alert
flow pid Process 82 1028 f.exe 82 1028 f.exe 59 1028 f.exe 59 1028 f.exe 148 1028 f.exe 148 1028 f.exe 87 1028 f.exe 87 1028 f.exe 130 1028 f.exe 130 1028 f.exe 183 1028 f.exe 183 1028 f.exe 169 1028 f.exe 169 1028 f.exe 76 1028 f.exe 76 1028 f.exe 65 1028 f.exe 65 1028 f.exe 75 1028 f.exe 75 1028 f.exe 89 1028 f.exe 89 1028 f.exe 147 1028 f.exe 147 1028 f.exe 135 1028 f.exe 135 1028 f.exe 10 1028 f.exe 10 1028 f.exe 100 1028 f.exe 100 1028 f.exe 157 1028 f.exe 157 1028 f.exe 136 1028 f.exe 136 1028 f.exe 187 1028 f.exe 187 1028 f.exe 13 1028 f.exe 13 1028 f.exe 29 1028 f.exe 29 1028 f.exe 40 1028 f.exe 40 1028 f.exe 64 1028 f.exe 64 1028 f.exe 173 1028 f.exe 173 1028 f.exe 79 1028 f.exe 79 1028 f.exe 184 1028 f.exe 184 1028 f.exe 185 1028 f.exe 185 1028 f.exe 25 1028 f.exe 25 1028 f.exe 37 1028 f.exe 37 1028 f.exe 144 1028 f.exe 144 1028 f.exe 146 1028 f.exe 146 1028 f.exe 117 1028 f.exe 117 1028 f.exe 180 1028 f.exe 180 1028 f.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname f.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain f.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1028 f.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1028 f.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 1028 f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f.exe"C:\Users\Admin\AppData\Local\Temp\f.exe"1⤵
- Suricata alert: REMCOS RAT Malware Outbound C2 Communication
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1028