PlugX host process (Jarte/GRrte) execution enabling system profiling

Kaung Khant Ko@kaungkhantko

•updated Sep 19, 2026•0•0•4

Detects execution of the PlugX side-loaded host process (Jarte.exe / GRrte.exe) from the JartePortable directory. This process performs in-memory host/system profiling (GetComputerNameW, GetVersionEx, system directory queries) via the decoded PlugX core (T1082), which is not directly visible as command-line telemetry.