dcb07928f2b91f05ee022505a2c0137e185bd260ec71b00e8dc7ee2f282a9108

Analysis

user interaction
yes
max time kernel
899s
max time network
464s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-uk
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-uklocale:uk-uaos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 15:27

Target
Ghost.exe
Size 1.7MB
Sample260809-svysgsba97
SHA256 dcb07928f2b91f05ee022505a2c0137e185bd260ec71b00e8dc7ee2f282a9108
MD5 35d3f771bdceeaf96cfd170ef50632b6
SHA1 3b1cdc9c544cfc0aa4e08863a59beb3cd496fe84
SHA512 28bb61a4da5dbde83a6322e5e669e528868ff1973649ffe4331394c597421e19637952da59b9b371c836ef279331b983e5163a1bee99bf04e09691dcba665377
SSDEEP 49152:568lEpdR+xCoSSyO16OkHg1lVIzdfCGg1G/hr7nWf:568lEpdFoSSyCkg1lVMdaGY67nW
TLSH
T1E385230323D044AAD079ABB594F7081B653ABDC0467547EF33A4D98E2E33BD6A43674B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Executes dropped EXE 2 IoCs

pid	Process
3252	AutoIt3.exe
4316	AutoIt3.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3252 set thread context of 4316	3252	AutoIt3.exe	92

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of FindShellTrayWindow 3 IoCs

Suspicious use of SendNotifyMessage 3 IoCs

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2604 wrote to memory of 5892	2604	Ghost.exe	88
PID 2604 wrote to memory of 3252	2604	Ghost.exe	91
PID 3252 wrote to memory of 4316	3252	AutoIt3.exe	92
PID 3252 wrote to memory of 4316	3252	AutoIt3.exe	92
PID 3252 wrote to memory of 4316	3252	AutoIt3.exe	92

C:\Users\Admin\AppData\Local\Temp\Ghost.exe
"C:\Users\Admin\AppData\Local\Temp\Ghost.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Windows\SYSTEM32\nslookup.exe
  nslookup.exe /ajdf478374urjskldhf843
  2⤵
  PID:5892
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe Exists.a3x
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3252
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
    3⤵
    - Executes dropped EXE
    PID:4316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1204

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:3544

AutoIt3.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
Size 1.0MB
SHA256 92c6531a09180fae8b2aae7384b4cea9986762f0c271b35da09b4d0e733f9f45
MD5 8fa52f316c393496f272357191db6deb
SHA1 b1ff3d48a3946ca7786a84e4a832617cd66fa3b9
SHA512 c81da97d6980d6a5aa612070477950a1386239bb919e762f7870bccd459a03da48f8f169910b91f3827c6cfef50471569c9e0c9ff2ceb897904d81840c087d51
SSDEEP 24576:5TC6Rb6qu1PyC+NRLtpScpzbtT7pyOolKL8Sq/jrc5xaNIBB:5+6AqSPyC+NltpScpzbtvpJoMQSq/jre
TLSH
T1FC357D0A23A4419EFEA7F176D617C60BD7B1784A0376962F02A46B726F337711A1E331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Exists.a3x

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Exists.a3x
Size 1.0MB
SHA256 1e9f2e28ede5c8f897cd827fbdec5770ae0365328d2473e9a003f3efaba5efc6
MD5 f7016faf30f56ea94afb21854905c071
SHA1 2efe0b45a49ae2fb1b561e18f2383e2b5a21002a
SHA512 cf11ebafa46379b7174417c581fb857cb6e3c4d9eb4d75a1810bcee9d854f6281c93479affc69ad3a628b12f81874fcc710b087a778ef6df18125c13e576a276
SSDEEP 24576:g+M8piSledONv4Ws0IxSdWy/1yOsNtjoWkxZIdmZif/3dVOvg9u:xpFe2gcoSsy/1yOsNtjoPICifyvg9u
TLSH
T167353317321165A88156FEE2F1BF042A314F0ECC10D9153A3ADBDE5E364E69B50AFAC7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3252-7-0x00007FFD7DFC0000-0x00007FFD7E223000-memory.dmp

Download

memory/3252-8-0x0000023BB90A0000-0x0000023BB90A1000-memory.dmp

Download

memory/4316-10-0x000002F254380000-0x000002F2543D2000-memory.dmp

Download

memory/4316-11-0x000002F254380000-0x000002F2543D2000-memory.dmp

Download