Analysis
- max time kernel
148s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/10/2026, 16:17
Behavioral task
behavioral1
Sample
1.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 1.exe
- Size 644KB
- Sample261027-trsyhaev2z
- SHA256 530ccfce35d0264c60c03d11b95499d4768f4486033a0ef20d85acba3682c22d
- MD5 68d2b38e29516a1da0f776967d5fdfa6
- SHA1 cc2f28a81c85bda3f5cb6e2d24a69073998c4f78
- SHA512 92001b2d925f1bd0b5babdcdd29e71f693ff46e588b6341f667f399b2d1c2c0dca4069a2dc711be5be402ec9875bf7dc7d243bd536c4d021720382548a267891
- SSDEEP 12288:5IfxS5XkH4nOqwitNfuquCwgs69gy3V5v+BNyo3PoL5aDz:e5GXkH4nnwitNfuq9wgs3y3V5vgNyo3E
- TLSH T184E46D59A39402F8D0B7C135C982953BE7B2BC065571472F03E70E9B2F276A16F3AB16
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Suricata alert: REMCOS RAT Malware Outbound C2 Communication 64 IoCs
Network activity triggered a Suricata alert
flow pid Process 19 3604 1.exe 19 3604 1.exe 27 3604 1.exe 27 3604 1.exe 91 3604 1.exe 91 3604 1.exe 47 3604 1.exe 47 3604 1.exe 16 3604 1.exe 16 3604 1.exe 44 3604 1.exe 44 3604 1.exe 129 3604 1.exe 129 3604 1.exe 95 3604 1.exe 95 3604 1.exe 120 3604 1.exe 120 3604 1.exe 92 3604 1.exe 92 3604 1.exe 102 3604 1.exe 102 3604 1.exe 17 3604 1.exe 17 3604 1.exe 9 3604 1.exe 9 3604 1.exe 88 3604 1.exe 88 3604 1.exe 68 3604 1.exe 68 3604 1.exe 79 3604 1.exe 79 3604 1.exe 101 3604 1.exe 101 3604 1.exe 24 3604 1.exe 24 3604 1.exe 25 3604 1.exe 25 3604 1.exe 70 3604 1.exe 70 3604 1.exe 62 3604 1.exe 62 3604 1.exe 135 3604 1.exe 135 3604 1.exe 90 3604 1.exe 90 3604 1.exe 3 3604 1.exe 3 3604 1.exe 50 3604 1.exe 50 3604 1.exe 131 3604 1.exe 131 3604 1.exe 10 3604 1.exe 10 3604 1.exe 6 3604 1.exe 6 3604 1.exe 36 3604 1.exe 36 3604 1.exe 122 3604 1.exe 122 3604 1.exe 94 3604 1.exe 94 3604 1.exe 132 3604 1.exe 132 3604 1.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 1.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3604 1.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3604 1.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 3604 1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"1⤵
- Suricata alert: REMCOS RAT Malware Outbound C2 Communication
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3604