022a8f905615a6a98f5a9d8ea96e2a0d08b79512dd75c574699af0db9a731150.exe

Summary

Methodology

The sample was executed in an isolated, instrumented Windows VM (host-only networking with emulated C2 responses) while process, file-system, registry and network activity were recorded. The verdict is derived by correlating observed runtime behaviour with static indicators. No sample binary was uploaded or redistributed.

Child processes (2)

• C:\WINDOWS\System32\Conhost.exe
• C:\argus-vr-agent\quarantine\022a8f905615a6a98f5a9d8ea96e2a0d08b79512dd75c574699af0db9a731150_extracted\022a8f905615a6a98f5a9d8ea96e2a0d08b79512dd75c574699af0db9a731150.exe

MITRE ATT&CK

YARA matches

Indicators of Compromise (defanged)

• 853da8240ad3eb6f99743dd686dc98872fa06e86
• e8408a211ade214e5a80cc310d63e347

IOCs (JSON)Copy

{
  "sha256": "022a8f905615a6a98f5a9d8ea96e2a0d08b79512dd75c574699af0db9a731150",
  "family": "RemcosRAT",
  "verdict": "suspicious",
  "confidence": 95,
  "signals": [
    "yara-match",
    "child-processes"
  ],
  "attack": [
    "T1059"
  ],
  "children": [
    "C:\\WINDOWS\\System32\\Conhost.exe",
    "C:\\argus-vr-agent\\quarantine\\022a8f905615a6a98f5a9d8ea96e2a0d08b79512dd75c574699af0db9a731150_extracted\\022a8f905615a6a98f5a9d8ea96e2a0d08b79512dd75c574699af0db9a731150.exe"
  ]
}