Analysis
- max time kernel
300s - max time network
291s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
22/08/2026, 04:05
General
- Target 洗群话术总结..exe
- Size 1.7MB
- Sample260822-enppcaeb46
- SHA256 c1c44e6c409b18f61e2fb811addfa22b1514682501e39d9399b021b8cb587426
Malware Config
Signatures
- Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
- Gh0st RAT payload 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 8 IoCs
- Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\洗群话术总结..exe"C:\Users\Admin\AppData\Local\Temp\洗群话术总结..exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\00C04FC964FF\6F9619FF.exe"C:\Users\Public\00C04FC964FF\6F9619FF.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\00C04FC964FF'"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_dcy2yv44.esq.ps1
6F9619FF.dat
6F9619FF.exe
libSWASync.dll
libcurl.dll
libeay32.dll
liboauth.dll
original_libSWASync.DLL
sqlite3.dll
task.dat
uEYYJqJOwXXJ.xcp
memory/1888-62-0x0000000006C30000-0x0000000006C62000-memory.dmp
memory/1888-75-0x0000000007FC0000-0x000000000863A000-memory.dmp
memory/1888-49-0x0000000005F70000-0x0000000005FD6000-memory.dmp
memory/1888-50-0x0000000005FE0000-0x0000000006046000-memory.dmp
memory/1888-47-0x0000000005850000-0x0000000005E78000-memory.dmp
memory/1888-58-0x0000000006050000-0x00000000063A4000-memory.dmp
memory/1888-59-0x0000000006660000-0x000000000667E000-memory.dmp
memory/1888-60-0x00000000066F0000-0x000000000673C000-memory.dmp
memory/1888-61-0x000000007F5E0000-0x000000007F5F0000-memory.dmp
memory/1888-46-0x0000000005210000-0x0000000005220000-memory.dmp
memory/1888-63-0x000000006F750000-0x000000006F79C000-memory.dmp
memory/1888-72-0x0000000005210000-0x0000000005220000-memory.dmp
memory/1888-71-0x0000000005210000-0x0000000005220000-memory.dmp
memory/1888-73-0x0000000006C10000-0x0000000006C2E000-memory.dmp
memory/1888-74-0x0000000007840000-0x00000000078E3000-memory.dmp
memory/1888-48-0x00000000056A0000-0x00000000056C2000-memory.dmp
memory/1888-76-0x0000000007970000-0x000000000798A000-memory.dmp
memory/1888-77-0x00000000079D0000-0x00000000079DA000-memory.dmp
memory/1888-78-0x0000000007C00000-0x0000000007C96000-memory.dmp
memory/1888-79-0x0000000007B70000-0x0000000007B81000-memory.dmp
memory/1888-80-0x0000000007BA0000-0x0000000007BAE000-memory.dmp
memory/1888-81-0x0000000007BB0000-0x0000000007BC4000-memory.dmp
memory/1888-82-0x0000000007CC0000-0x0000000007CDA000-memory.dmp
memory/1888-83-0x0000000007BF0000-0x0000000007BF8000-memory.dmp
memory/1888-45-0x0000000003080000-0x00000000030B6000-memory.dmp
memory/1888-44-0x0000000005210000-0x0000000005220000-memory.dmp
memory/4332-87-0x00000000034B0000-0x0000000003547000-memory.dmp
memory/4332-89-0x0000000003550000-0x00000000035CB000-memory.dmp
memory/4332-98-0x0000000060900000-0x0000000060970000-memory.dmp
memory/4332-42-0x0000000001530000-0x0000000001642000-memory.dmp