Analysis
- max time kernel
148s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
31/10/2026, 01:14
Behavioral task
behavioral1
Sample
2.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2.exe
- Size 645KB
- Sample261031-blqbbatsg1
- SHA256 a8d7a25745b606ab86070e9320e20e3f88c0491769f03ffc8164263bf47c69e1
- MD5 eaa1fc800d3b99ea5480123670029600
- SHA1 2b65e53108e89c05e197f125cdee551d6b7c8918
- SHA512 05f50bc0772fe93a3a4f48a6dab074a441620900d0b9b6909b6cf74bcbda2b1d69b4af8d5f445631f4fe888a614bdfe86638bf20d7dc70c3768d73ffe3df90c7
- SSDEEP 12288:3IfxS5XkH4nOqwitNfuquCwgs69gy3V5v+BNyo3PoL5aDz:45GXkH4nnwitNfuq9wgs3y3V5vgNyo3E
- TLSH T10CE46D59A39402F8D0B7C135C982952BE7B2BC065571472F03E70E9B2F277A16F3AB16
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Suricata alert: REMCOS RAT Malware Outbound C2 Communication 64 IoCs
Network activity triggered a Suricata alert
flow pid Process 98 2416 2.exe 98 2416 2.exe 186 2416 2.exe 186 2416 2.exe 204 2416 2.exe 204 2416 2.exe 223 2416 2.exe 223 2416 2.exe 289 2416 2.exe 289 2416 2.exe 256 2416 2.exe 256 2416 2.exe 49 2416 2.exe 49 2416 2.exe 60 2416 2.exe 60 2416 2.exe 83 2416 2.exe 83 2416 2.exe 140 2416 2.exe 140 2416 2.exe 236 2416 2.exe 236 2416 2.exe 269 2416 2.exe 269 2416 2.exe 295 2416 2.exe 295 2416 2.exe 300 2416 2.exe 300 2416 2.exe 25 2416 2.exe 25 2416 2.exe 127 2416 2.exe 127 2416 2.exe 177 2416 2.exe 177 2416 2.exe 254 2416 2.exe 254 2416 2.exe 13 2416 2.exe 13 2416 2.exe 41 2416 2.exe 41 2416 2.exe 28 2416 2.exe 28 2416 2.exe 88 2416 2.exe 88 2416 2.exe 92 2416 2.exe 92 2416 2.exe 91 2416 2.exe 91 2416 2.exe 16 2416 2.exe 16 2416 2.exe 73 2416 2.exe 73 2416 2.exe 70 2416 2.exe 70 2416 2.exe 169 2416 2.exe 169 2416 2.exe 154 2416 2.exe 154 2416 2.exe 168 2416 2.exe 168 2416 2.exe 216 2416 2.exe 216 2416 2.exe 87 2416 2.exe 87 2416 2.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 2.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2416 2.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2416 2.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2416 2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2.exe"C:\Users\Admin\AppData\Local\Temp\2.exe"1⤵
- Suricata alert: REMCOS RAT Malware Outbound C2 Communication
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2416
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:5476