Analysis
- max time kernel
148s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/10/2026, 08:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d96d07fc7a42d29a96267d02f75aa601b76f670447dd12c99fa3bb800bdfd6e6.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
d96d07fc7a42d29a96267d02f75aa601b76f670447dd12c99fa3bb800bdfd6e6.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
16 signatures
150 seconds
General
- Target d96d07fc7a42d29a96267d02f75aa601b76f670447dd12c99fa3bb800bdfd6e6.exe
- Size 3.4MB
- Sample261028-krydjszvg1
- SHA256 d96d07fc7a42d29a96267d02f75aa601b76f670447dd12c99fa3bb800bdfd6e6
- MD5 837aa54c7aad68bd76fd500680d6f250
- SHA1 92f68780acf5b7989466a89fea5cbab2a4e3f713
- SHA512 d1e019adb2dad39c0b7875d1c413b60722341f2f317dabcc56330d062776f396739682e8ad5609ea35a839a8a247b63197b21cf3a9bfcda1f2b40befca912ed6
- SSDEEP 98304:uP+ss+98XiHseQxNvo1YWEfZEot75oozFhPOU9CClf:uPpx9vH8xUYWEfZEot75oozFhPOU9CC
- TLSH T177F56C8A63ED00D4D6A6E07DC5175A0BD7B2B8150330D7EF02658A9B9F336A21E7F361
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/memory/4396-66-0x00000000032D0000-0x000000000334B000-memory.dmp family_gh0strat - Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
pid Process 3660 powershell.exe 3660 powershell.exe - Executes dropped EXE 1 IoCs
pid Process 4396 ishare_user.exe - Loads dropped DLL 8 IoCs
pid Process 4396 ishare_user.exe 4396 ishare_user.exe 4396 ishare_user.exe 4396 ishare_user.exe 4396 ishare_user.exe 4396 ishare_user.exe 4396 ishare_user.exe 4396 ishare_user.exe - Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: ishare_user.exe File opened (read-only) \??\Y: ishare_user.exe File opened (read-only) \??\B: ishare_user.exe File opened (read-only) \??\J: ishare_user.exe File opened (read-only) \??\N: ishare_user.exe File opened (read-only) \??\R: ishare_user.exe File opened (read-only) \??\U: ishare_user.exe File opened (read-only) \??\W: ishare_user.exe File opened (read-only) \??\X: ishare_user.exe File opened (read-only) \??\I: ishare_user.exe File opened (read-only) \??\K: ishare_user.exe File opened (read-only) \??\M: ishare_user.exe File opened (read-only) \??\O: ishare_user.exe File opened (read-only) \??\Z: ishare_user.exe File opened (read-only) \??\D: ishare_user.exe File opened (read-only) \??\G: ishare_user.exe File opened (read-only) \??\L: ishare_user.exe File opened (read-only) \??\P: ishare_user.exe File opened (read-only) \??\T: ishare_user.exe File opened (read-only) \??\H: ishare_user.exe File opened (read-only) \??\Q: ishare_user.exe File opened (read-only) \??\S: ishare_user.exe - Enumerates video capture drivers 2 TTPs 1 IoCs
Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9 ishare_user.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain ishare_user.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname d96d07fc7a42d29a96267d02f75aa601b76f670447dd12c99fa3bb800bdfd6e6.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain d96d07fc7a42d29a96267d02f75aa601b76f670447dd12c99fa3bb800bdfd6e6.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname ishare_user.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ishare_user.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ishare_user.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ishare_user.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 5812 d96d07fc7a42d29a96267d02f75aa601b76f670447dd12c99fa3bb800bdfd6e6.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3660 powershell.exe 3660 powershell.exe 4396 ishare_user.exe 4396 ishare_user.exe 4396 ishare_user.exe 4396 ishare_user.exe 4396 ishare_user.exe 4396 ishare_user.exe 4396 ishare_user.exe 4396 ishare_user.exe 4396 ishare_user.exe 4396 ishare_user.exe 4396 ishare_user.exe 4396 ishare_user.exe 4396 ishare_user.exe 4396 ishare_user.exe 4396 ishare_user.exe 4396 ishare_user.exe 4396 ishare_user.exe 4396 ishare_user.exe 4396 ishare_user.exe 4396 ishare_user.exe 4396 ishare_user.exe 4396 ishare_user.exe 4396 ishare_user.exe 4396 ishare_user.exe 4396 ishare_user.exe 4396 ishare_user.exe 4396 ishare_user.exe 4396 ishare_user.exe 4396 ishare_user.exe 4396 ishare_user.exe 4396 ishare_user.exe 4396 ishare_user.exe 4396 ishare_user.exe 4396 ishare_user.exe 4396 ishare_user.exe 4396 ishare_user.exe 4396 ishare_user.exe 4396 ishare_user.exe 4396 ishare_user.exe 4396 ishare_user.exe 4396 ishare_user.exe 4396 ishare_user.exe 4396 ishare_user.exe 4396 ishare_user.exe 4396 ishare_user.exe 4396 ishare_user.exe 4396 ishare_user.exe 4396 ishare_user.exe 4396 ishare_user.exe 4396 ishare_user.exe 4396 ishare_user.exe 4396 ishare_user.exe 4396 ishare_user.exe 4396 ishare_user.exe 4396 ishare_user.exe 4396 ishare_user.exe 4396 ishare_user.exe 4396 ishare_user.exe 4396 ishare_user.exe 4396 ishare_user.exe 4396 ishare_user.exe 4396 ishare_user.exe - Suspicious use of AdjustPrivilegeToken 22 IoCs
description pid Process Token: SeDebugPrivilege 3660 powershell.exe Token: SeIncreaseQuotaPrivilege 3660 powershell.exe Token: SeSecurityPrivilege 3660 powershell.exe Token: SeTakeOwnershipPrivilege 3660 powershell.exe Token: SeLoadDriverPrivilege 3660 powershell.exe Token: SeSystemProfilePrivilege 3660 powershell.exe Token: SeSystemtimePrivilege 3660 powershell.exe Token: SeProfSingleProcessPrivilege 3660 powershell.exe Token: SeIncBasePriorityPrivilege 3660 powershell.exe Token: SeCreatePagefilePrivilege 3660 powershell.exe Token: SeBackupPrivilege 3660 powershell.exe Token: SeRestorePrivilege 3660 powershell.exe Token: SeShutdownPrivilege 3660 powershell.exe Token: SeDebugPrivilege 3660 powershell.exe Token: SeSystemEnvironmentPrivilege 3660 powershell.exe Token: SeRemoteShutdownPrivilege 3660 powershell.exe Token: SeUndockPrivilege 3660 powershell.exe Token: SeManageVolumePrivilege 3660 powershell.exe Token: 33 3660 powershell.exe Token: 34 3660 powershell.exe Token: 35 3660 powershell.exe Token: 36 3660 powershell.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5812 d96d07fc7a42d29a96267d02f75aa601b76f670447dd12c99fa3bb800bdfd6e6.exe 5812 d96d07fc7a42d29a96267d02f75aa601b76f670447dd12c99fa3bb800bdfd6e6.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 5812 wrote to memory of 4396 5812 d96d07fc7a42d29a96267d02f75aa601b76f670447dd12c99fa3bb800bdfd6e6.exe 89 PID 4396 wrote to memory of 3660 4396 ishare_user.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\d96d07fc7a42d29a96267d02f75aa601b76f670447dd12c99fa3bb800bdfd6e6.exe"C:\Users\Admin\AppData\Local\Temp\d96d07fc7a42d29a96267d02f75aa601b76f670447dd12c99fa3bb800bdfd6e6.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5812 -
C:\Users\Public\assist4\ishare_user.exe"C:\Users\Public\assist4\ishare_user.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Enumerates video capture drivers
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\assist4'"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3660
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_41yvquay.5bh.psm1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Public\assist4\LIBEAY32.dll
- Size 1.0MB
- SHA256 95a9bf1f13ef61c063b3705dbc457a2891ef35947f09bc8360d6e439e05d77b5
- MD5 220c1b7e726e840a98267ed1cd152de2
- SHA1 b0f723b900c427489cc246f590dd27c05842f372
- SHA512 d0c5e6da4d296f2e9864d4bf8136db32c83065fd38fc943ab047830827fa7a9d8e39457135363dedbb4634c2ab940dc20ea946df09f571ae237266cd681b3f92
- SSDEEP 24576:U3TJLu0xAoU/Ifu+ks8dbWmuIBnLPAMfApVzPXJrIBN64c:01dFfBks8dbWUYMYpVjXJGNvc
- TLSH T1D1359D07F78589B2E88E867D25B7567F5A339A024329C6C38BA039419D701E17BBF3C5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\assist4\ishare_user.dat
- Size 61B
- SHA256 f35c2d63f568d57ca4a6f932fb2c5d0a89bfb387fd342aa1110f59a5d3ea7492
- MD5 7b9e5953086ca12182e9ab63e628c2e9
- SHA1 7a03b2d35d80a5e37be9b5f8518776b24d35c618
- SHA512 0050542caf8e5344b0aa4676d9fd381b5bbe747106647ed086a59198d1c351966340ec1847eb302a96746a32be1603c17d42bda1cf7d51deece4d0ef68abcb5d
- TLSH T1ACA002816060804945154F05382D19D7966259585BC56075E3D6959959142C3154C745
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Public\assist4\ishare_user.exe
- Size 2.9MB
- SHA256 729d22ef6f8765e79f76209d19822a08e0f696ae26b8396beadf47207931d9e9
- MD5 e18fbaa50258345c5310b16ada166c36
- SHA1 ac157426d2a105ac08ee86214a515b4c916ae87c
- SHA512 4d8e640ceac78c8b4ad63669e90f68dc95ddde16c6552c14937002289b94053979bbc3fbb772b6eb8c211885cac6ee8834e7d07c3d6e76584b68e6f6924eebfe
- SSDEEP 24576:vnyQDOqwc4/claXufUhdEI8fUhdEIPgSgs:vyvqw5UlaXufUnEI8fUnEIPjgs
- TLSH T1BFD58D21F700E43AE5B718F6CD7DAB5C461D6E62070101E7B3CC3A5E6AB56D22E3192B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\assist4\libSWASync.dll
- Size 104KB
- SHA256 694a94215e721f718aec8dbe9a4b4ce4e276d83e93fc3e150b03e312b04c6ae5
- MD5 847357fe2bea1cd74e8b339f8b799faa
- SHA1 d8d18215a3a632354f2cb574ac102426f9e0eb12
- SHA512 a8db5018e1a54e161843ccbac2a875ed0fc8489f87c12669f0438c6e72583439c88e20e7d1bd7f8a9d7cace491f3c6e842e472902a4fbc3960130c5ebfbec3b5
- SSDEEP 3072:tBI8vOeo2PqB5iIeO0gq38X1lE4aBXEjo8:t68vS5SO3CKYSo8
- TLSH T134A32951B6EBC130DCAE573D892D8A20473B6891CB14BCD7636C15E90E383D2BE3695B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\assist4\libcurl.dll
- Size 390KB
- SHA256 45da86a8059f9a4dc6bb6b0eff1e7f48d9eabf71bb05900b0b37433275c245a3
- MD5 7ece26f933b8d3a6b4dfcf9edc77f8f9
- SHA1 86714fbd36122941fbf83313e427d466c9e9a69b
- SHA512 2d8edbb19ed8d03591ac31d690ce1c95640c0fbbbb6d4da0db2dff9b90ee1869dee71ce7b5a20dca7771d2e13db9cc9e227174ced6df9df0664ffabf016e351a
- SSDEEP 12288:VsGA+UxNPvOm986MhjfC5SCD2L5qGsU+m5O4S5GuO7gKTUzsG8:bUveGGqm5O4vTT
- TLSH T1AD84AF96FF8080F1E8C25379316A27BB1D39A2441329C5D3EF945EA55E126E1B73C3CA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\assist4\liboauth.dll
- Size 21KB
- SHA256 231a753658d8bff56419783f68dfc7b9ce295bb72dd2ccd8cfbe0a1d67674074
- MD5 16ed6eb567c0bc183198016920de7cef
- SHA1 fa0b41adf8e178e5e60b7251b29eeeaf2079b677
- SHA512 8ffd9d4dd4ef705b8ca7b17dccf4a7b1279ccf2b77af9b6bf2169aa3259f74694a2df17836bbeb1a568047d307e59b525e5b04c84bb31e979b8fc8f28ae5ef93
- SSDEEP 192:ER+QGHW3XvHBa8PxR6+oMRgoXMcdUBSZDYl+z0rcecnQCX7SR3giMb1lRMdm53XV:KqW3XvH45iFgS3kcecn/SRkREmFuhl
- TLSH T195A23B86ADAD40A1ED542CB870A33F23173C6377677708C7D7A34A994E50EF36A72216
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\assist4\original_libSWASync.DLL
- Size 599KB
- SHA256 b7697f1c734bb64176c09ebe9b1a16eee5e14eae58a7bd5d6ba02695ec732056
- MD5 97f30e4475857222e155a7c3c3269d7c
- SHA1 4d38a5a5915d709ed25aeea8f7ed77f91f48b41a
- SHA512 f17b97e1273de0f1fc2530d1435758b47c3db7286036ef441984af0d7317a684a77117adacb944f6ce2cdd690d3ccd3250bd870988d85e4282974755c4537df8
- SSDEEP 12288:vduh+K+iCybCKZjy17RRdqyoNYbRuGfaVKCB:vDKTy1tRdqPSPyz
- TLSH T16CD44A93BBAAC2B6DD5D31BC00199F3E876C7A45132055E3A78C4F0A4A725E37D3B246
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\assist4\sqlite3.dll
- Size 508KB
- SHA256 de818c832308b82c2fabd5d3d4339c489e6f4e9d32bb8152c0dcd8359392695f
- MD5 0f66e8e2340569fb17e774dac2010e31
- SHA1 406bb6854e7384ff77c0b847bf2f24f3315874a3
- SHA512 39275df6e210836286e62a95ace7f66c7d2736a07b80f9b7e9bd2a716a6d074c79deae54e2d21505b74bac63df0328d6780a2129cdfda93aec1f75b523da9e05
- SSDEEP 6144:RgEF6lmEVKtkDCQ/kUrc7dBLhuKgrQCjBXPTnrKcCxcfKvrLJLqgx5YMk4HJ0yPF:GEEdkUrc7RuKcQCdGVtT0MkCwwV/Hn
- TLSH T100B45C53A452DC39E8D202B481720737966CDAA0DD63EB43A5D1F93B6EF35C1B62930B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\assist4\task.dat
- Size 85B
- SHA256 8924511071565216d256b3671765c0f649f5da417bed68ed40c0286ac60fbba7
- MD5 7cf5263c8b3a1e50d4a9ceaf552257af
- SHA1 48ea9f94cf6ad9423c751167ae40218eff4959b7
- SHA512 6354e7e982c2c879e96435fbfe77d84f021e9ea02cd8e82dcc1a184d62b53bb778ff203bc37279a5b72a689d11fe9758170f188216e2b401eb0397ee864fbb16
- TLSH T10FA01290640485CF18001647622500B328D21415056B1210857434CA180084717AA931
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Public\assist4\uEYYJqJOwXXJ.xcp
- Size 583KB
- SHA256 67a97568547afc24c31d7d3792181d0f1a4021f6da037cca884c37f054c40cd9
- MD5 108ec3ccfd61a16d3928de7ce0d8cb57
- SHA1 41c4e1b4dfe29b7014902065d79df39dc3b8a1d7
- SHA512 943b2f71af91c739cbd837b02bf61c840d0f9dcd92ff47f256627076414f9875a7a5506ccab8c8d127b264088273c3941fb38ee6d1e1486e8dfbfc18293c957d
- SSDEEP 12288:pfU9iPLH4+GuxJ5aKNTA+RNsrmKEcOckon9JDQkPaXVZV3Z9hWcEO:dU9qY+NxJ5aKPTsrPEcO9yXNSVZNZvV
- TLSH T1F6D43371C0B265EF96186EBC7F45607E76362781CF3E051382209391DA71C5A8A2E8FF
- MD5 SHA1 SHA512 SSDEEP TLSH