Analysis
- max time kernel
298s - max time network
301s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
22/08/2026, 04:05
General
- Target 洗群话术总结..exe
- Size 1.7MB
- Sample260822-enppcaeb46
- SHA256 c1c44e6c409b18f61e2fb811addfa22b1514682501e39d9399b021b8cb587426
Malware Config
Signatures
- Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
- Gh0st RAT payload 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 9 IoCs
- Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 22 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\洗群话术总结..exe"C:\Users\Admin\AppData\Local\Temp\洗群话术总结..exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\00C04FC964FF\6F9619FF.exe"C:\Users\Public\00C04FC964FF\6F9619FF.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\00C04FC964FF'"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
6F9619FF.dat
6F9619FF.exe
LIBEAY32.dll
libSWASync.dll
libcurl.dll
liboauth.dll
original_libSWASync.DLL
sqlite3.dll
task.dat
uEYYJqJOwXXJ.xcp
memory/1008-41-0x00000000011F0000-0x0000000001252000-memory.dmp
memory/1008-84-0x0000000060900000-0x0000000060970000-memory.dmp
memory/1008-73-0x0000000003240000-0x00000000032D7000-memory.dmp
memory/1008-75-0x0000000002B30000-0x0000000002BAB000-memory.dmp
memory/2876-55-0x0000000005ED0000-0x0000000005F1C000-memory.dmp
memory/2876-64-0x00000000071E0000-0x00000000071FA000-memory.dmp
memory/2876-50-0x0000000005930000-0x0000000005996000-memory.dmp
memory/2876-54-0x0000000005E80000-0x0000000005E9E000-memory.dmp
memory/2876-49-0x00000000058C0000-0x0000000005926000-memory.dmp
memory/2876-56-0x0000000074520000-0x0000000074CDC000-memory.dmp
memory/2876-57-0x0000000007030000-0x0000000007066000-memory.dmp
memory/2876-58-0x00000000708C0000-0x000000007090C000-memory.dmp
memory/2876-61-0x0000000006460000-0x0000000006480000-memory.dmp
memory/2876-62-0x00000000070A0000-0x0000000007143000-memory.dmp
memory/2876-63-0x0000000007820000-0x0000000007E9C000-memory.dmp
memory/2876-53-0x00000000059A0000-0x0000000005CFB000-memory.dmp
memory/2876-65-0x0000000007250000-0x000000000725A000-memory.dmp
memory/2876-66-0x0000000007450000-0x00000000074E6000-memory.dmp
memory/2876-67-0x0000000074520000-0x0000000074CDC000-memory.dmp
memory/2876-68-0x0000000074520000-0x0000000074CDC000-memory.dmp
memory/2876-69-0x0000000074520000-0x0000000074CDC000-memory.dmp
memory/2876-71-0x0000000074520000-0x0000000074CDC000-memory.dmp
memory/2876-48-0x0000000005090000-0x00000000050B2000-memory.dmp
memory/2876-47-0x0000000074520000-0x0000000074CDC000-memory.dmp
memory/2876-46-0x0000000074520000-0x0000000074CDC000-memory.dmp
memory/2876-45-0x0000000005270000-0x00000000058BA000-memory.dmp
memory/2876-44-0x0000000002980000-0x00000000029B6000-memory.dmp
memory/2876-43-0x0000000074532000-0x0000000074533000-memory.dmp