Analysis
- max time kernel
60s - max time network
61s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/10/2026, 20:12
Behavioral task
behavioral1
Sample
1ea80e07a96236101d4c81a3b9143242b0098213eb1900b538f031e10c1bae84.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
60 seconds
General
- Target 1ea80e07a96236101d4c81a3b9143242b0098213eb1900b538f031e10c1bae84.exe
- Size 645KB
- Sample261029-yyweescd23
- SHA256 1ea80e07a96236101d4c81a3b9143242b0098213eb1900b538f031e10c1bae84
- MD5 85202a350515d59fc0b4a8a51db79355
- SHA1 8dc3480636ada7b5721d211afc112f97cd1c11e4
- SHA512 0c2c6d122d4b86dc2aee4ef2f29b9fd7dfc31a78b136bf7d3fbe110ff718c8ffd786fbd931ee3aae941b39de48d229de6dc116264dae0ef0376da0aa0392b6c1
- SSDEEP 12288:vIfxS5XkH4nOqwitNfuquCwgs69gy3V5v+BNyo3PoL5aDz:w5GXkH4nnwitNfuq9wgs3y3V5vgNyo3E
- TLSH T18CE46D59A39402F8D0B7C135C982953BE7B2BC065571472F03D70E9B2F276A16F3AB26
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Suricata alert: REMCOS RAT Malware Outbound C2 Communication 64 IoCs
Network activity triggered a Suricata alert
flow pid Process 27 4936 1ea80e07a96236101d4c81a3b9143242b0098213eb1900b538f031e10c1bae84.exe 27 4936 1ea80e07a96236101d4c81a3b9143242b0098213eb1900b538f031e10c1bae84.exe 29 4936 1ea80e07a96236101d4c81a3b9143242b0098213eb1900b538f031e10c1bae84.exe 29 4936 1ea80e07a96236101d4c81a3b9143242b0098213eb1900b538f031e10c1bae84.exe 124 4936 1ea80e07a96236101d4c81a3b9143242b0098213eb1900b538f031e10c1bae84.exe 124 4936 1ea80e07a96236101d4c81a3b9143242b0098213eb1900b538f031e10c1bae84.exe 109 4936 1ea80e07a96236101d4c81a3b9143242b0098213eb1900b538f031e10c1bae84.exe 109 4936 1ea80e07a96236101d4c81a3b9143242b0098213eb1900b538f031e10c1bae84.exe 72 4936 1ea80e07a96236101d4c81a3b9143242b0098213eb1900b538f031e10c1bae84.exe 72 4936 1ea80e07a96236101d4c81a3b9143242b0098213eb1900b538f031e10c1bae84.exe 97 4936 1ea80e07a96236101d4c81a3b9143242b0098213eb1900b538f031e10c1bae84.exe 97 4936 1ea80e07a96236101d4c81a3b9143242b0098213eb1900b538f031e10c1bae84.exe 167 4936 1ea80e07a96236101d4c81a3b9143242b0098213eb1900b538f031e10c1bae84.exe 167 4936 1ea80e07a96236101d4c81a3b9143242b0098213eb1900b538f031e10c1bae84.exe 91 4936 1ea80e07a96236101d4c81a3b9143242b0098213eb1900b538f031e10c1bae84.exe 91 4936 1ea80e07a96236101d4c81a3b9143242b0098213eb1900b538f031e10c1bae84.exe 104 4936 1ea80e07a96236101d4c81a3b9143242b0098213eb1900b538f031e10c1bae84.exe 104 4936 1ea80e07a96236101d4c81a3b9143242b0098213eb1900b538f031e10c1bae84.exe 164 4936 1ea80e07a96236101d4c81a3b9143242b0098213eb1900b538f031e10c1bae84.exe 164 4936 1ea80e07a96236101d4c81a3b9143242b0098213eb1900b538f031e10c1bae84.exe 110 4936 1ea80e07a96236101d4c81a3b9143242b0098213eb1900b538f031e10c1bae84.exe 110 4936 1ea80e07a96236101d4c81a3b9143242b0098213eb1900b538f031e10c1bae84.exe 105 4936 1ea80e07a96236101d4c81a3b9143242b0098213eb1900b538f031e10c1bae84.exe 105 4936 1ea80e07a96236101d4c81a3b9143242b0098213eb1900b538f031e10c1bae84.exe 122 4936 1ea80e07a96236101d4c81a3b9143242b0098213eb1900b538f031e10c1bae84.exe 122 4936 1ea80e07a96236101d4c81a3b9143242b0098213eb1900b538f031e10c1bae84.exe 139 4936 1ea80e07a96236101d4c81a3b9143242b0098213eb1900b538f031e10c1bae84.exe 139 4936 1ea80e07a96236101d4c81a3b9143242b0098213eb1900b538f031e10c1bae84.exe 58 4936 1ea80e07a96236101d4c81a3b9143242b0098213eb1900b538f031e10c1bae84.exe 58 4936 1ea80e07a96236101d4c81a3b9143242b0098213eb1900b538f031e10c1bae84.exe 170 4936 1ea80e07a96236101d4c81a3b9143242b0098213eb1900b538f031e10c1bae84.exe 170 4936 1ea80e07a96236101d4c81a3b9143242b0098213eb1900b538f031e10c1bae84.exe 92 4936 1ea80e07a96236101d4c81a3b9143242b0098213eb1900b538f031e10c1bae84.exe 92 4936 1ea80e07a96236101d4c81a3b9143242b0098213eb1900b538f031e10c1bae84.exe 40 4936 1ea80e07a96236101d4c81a3b9143242b0098213eb1900b538f031e10c1bae84.exe 40 4936 1ea80e07a96236101d4c81a3b9143242b0098213eb1900b538f031e10c1bae84.exe 46 4936 1ea80e07a96236101d4c81a3b9143242b0098213eb1900b538f031e10c1bae84.exe 46 4936 1ea80e07a96236101d4c81a3b9143242b0098213eb1900b538f031e10c1bae84.exe 87 4936 1ea80e07a96236101d4c81a3b9143242b0098213eb1900b538f031e10c1bae84.exe 87 4936 1ea80e07a96236101d4c81a3b9143242b0098213eb1900b538f031e10c1bae84.exe 140 4936 1ea80e07a96236101d4c81a3b9143242b0098213eb1900b538f031e10c1bae84.exe 140 4936 1ea80e07a96236101d4c81a3b9143242b0098213eb1900b538f031e10c1bae84.exe 159 4936 1ea80e07a96236101d4c81a3b9143242b0098213eb1900b538f031e10c1bae84.exe 159 4936 1ea80e07a96236101d4c81a3b9143242b0098213eb1900b538f031e10c1bae84.exe 32 4936 1ea80e07a96236101d4c81a3b9143242b0098213eb1900b538f031e10c1bae84.exe 32 4936 1ea80e07a96236101d4c81a3b9143242b0098213eb1900b538f031e10c1bae84.exe 41 4936 1ea80e07a96236101d4c81a3b9143242b0098213eb1900b538f031e10c1bae84.exe 41 4936 1ea80e07a96236101d4c81a3b9143242b0098213eb1900b538f031e10c1bae84.exe 62 4936 1ea80e07a96236101d4c81a3b9143242b0098213eb1900b538f031e10c1bae84.exe 62 4936 1ea80e07a96236101d4c81a3b9143242b0098213eb1900b538f031e10c1bae84.exe 147 4936 1ea80e07a96236101d4c81a3b9143242b0098213eb1900b538f031e10c1bae84.exe 147 4936 1ea80e07a96236101d4c81a3b9143242b0098213eb1900b538f031e10c1bae84.exe 102 4936 1ea80e07a96236101d4c81a3b9143242b0098213eb1900b538f031e10c1bae84.exe 102 4936 1ea80e07a96236101d4c81a3b9143242b0098213eb1900b538f031e10c1bae84.exe 126 4936 1ea80e07a96236101d4c81a3b9143242b0098213eb1900b538f031e10c1bae84.exe 126 4936 1ea80e07a96236101d4c81a3b9143242b0098213eb1900b538f031e10c1bae84.exe 173 4936 1ea80e07a96236101d4c81a3b9143242b0098213eb1900b538f031e10c1bae84.exe 173 4936 1ea80e07a96236101d4c81a3b9143242b0098213eb1900b538f031e10c1bae84.exe 33 4936 1ea80e07a96236101d4c81a3b9143242b0098213eb1900b538f031e10c1bae84.exe 33 4936 1ea80e07a96236101d4c81a3b9143242b0098213eb1900b538f031e10c1bae84.exe 75 4936 1ea80e07a96236101d4c81a3b9143242b0098213eb1900b538f031e10c1bae84.exe 75 4936 1ea80e07a96236101d4c81a3b9143242b0098213eb1900b538f031e10c1bae84.exe 129 4936 1ea80e07a96236101d4c81a3b9143242b0098213eb1900b538f031e10c1bae84.exe 129 4936 1ea80e07a96236101d4c81a3b9143242b0098213eb1900b538f031e10c1bae84.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 1ea80e07a96236101d4c81a3b9143242b0098213eb1900b538f031e10c1bae84.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 1ea80e07a96236101d4c81a3b9143242b0098213eb1900b538f031e10c1bae84.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4936 1ea80e07a96236101d4c81a3b9143242b0098213eb1900b538f031e10c1bae84.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4936 1ea80e07a96236101d4c81a3b9143242b0098213eb1900b538f031e10c1bae84.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 4936 1ea80e07a96236101d4c81a3b9143242b0098213eb1900b538f031e10c1bae84.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1ea80e07a96236101d4c81a3b9143242b0098213eb1900b538f031e10c1bae84.exe"C:\Users\Admin\AppData\Local\Temp\1ea80e07a96236101d4c81a3b9143242b0098213eb1900b538f031e10c1bae84.exe"1⤵
- Suricata alert: REMCOS RAT Malware Outbound C2 Communication
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4936