Analysis
-
max time kernel
7s -
max time network
439s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
-
submitted
09-12-2023 19:12
General
-
Target
CyberGhostVPNSetup (2).exe
-
Size
127KB
-
MD5
fd093f3100a56b710c50d41667da7e2b
-
SHA1
5ec9063e4380f642d2a551da76fd4d3f00fd4c96
-
SHA256
f6dfae75fd23c0446ec1721994cf2530c66bd76366423176414747b39153bf58
-
SHA512
d3daebf6e3669a4b2a944e60d97c86fd31878cea66e252f05ea8d23f92c1f02ef8e6f4dda250b979a9b9df3fa71dc43c4ab98e2cae52e7687861d1e9a3dd09c0
-
SSDEEP
3072:ACNd5JY06+ywjDnJShh8N7JNzFrxO/DLxPO4GV:TNVPtVQ7LtOz
Malware Config
Signatures
-
Detect PureLogs payload 1 IoCs
-
PureLogs
PureLogs is an infostealer written in C#.
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Drops file in Program Files directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies system certificate store 2 TTPs 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\CyberGhostVPNSetup (2).exe"C:\Users\Admin\AppData\Local\Temp\CyberGhostVPNSetup (2).exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\794e1281-90b0-4ba7-85fc-f1deafd114cd\759852cb-80b0-41ff-9693-434ff9b4e818.exe"C:\Program Files\794e1281-90b0-4ba7-85fc-f1deafd114cd\759852cb-80b0-41ff-9693-434ff9b4e818.exe" "C:\Users\Admin\AppData\Local\Temp\CyberGhostVPNSetup (2).exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.0MB
MD572540194bd451dac050609406eb50a56
SHA157c33ec10f90f81f6abc612b4d251510c36ebd6b
SHA2563a18d5fd76abcfe537d78457dab4797231af313028b5594231f019245c5f7a74
SHA512ec9b24c877e82269aba78701a9828879e8b91580c4d3002227ee18868b8db76b6c0fba08e687aba1ea3127eea05e37124e2b615c224b33e4dac2512dbefb3444
-
Filesize
5.0MB
MD572540194bd451dac050609406eb50a56
SHA157c33ec10f90f81f6abc612b4d251510c36ebd6b
SHA2563a18d5fd76abcfe537d78457dab4797231af313028b5594231f019245c5f7a74
SHA512ec9b24c877e82269aba78701a9828879e8b91580c4d3002227ee18868b8db76b6c0fba08e687aba1ea3127eea05e37124e2b615c224b33e4dac2512dbefb3444
-
Filesize
5.0MB
MD572540194bd451dac050609406eb50a56
SHA157c33ec10f90f81f6abc612b4d251510c36ebd6b
SHA2563a18d5fd76abcfe537d78457dab4797231af313028b5594231f019245c5f7a74
SHA512ec9b24c877e82269aba78701a9828879e8b91580c4d3002227ee18868b8db76b6c0fba08e687aba1ea3127eea05e37124e2b615c224b33e4dac2512dbefb3444
-
Filesize
2KB
MD5647f843626b023aaaa748f924f95ac25
SHA1652cacf99409e3dcd39b6eb8839c16d22b1800e8
SHA256732dee732e0261afbfba21eca43008a5009cfc9e4c405ece8826a9746564cceb
SHA51261093dcbe07efa5bdffec4933243168bf40b8159bc5a9840552bc3ea8e7c129156276a8548c658e5267bf0b8c4448dcb5c8ab10140c72ed48eb8910c075022fa
-
Filesize
136KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
1.8MB
-
Filesize
5.2MB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
592KB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
640KB
-
Filesize
104KB
-
Filesize
280KB
-
Filesize
56KB
-
Filesize
168KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
600KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
88KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
56KB
-
Filesize
224KB
-
Filesize
232KB
-
Filesize
224KB
-
Filesize
64KB
-
Filesize
136KB
-
Filesize
40KB
-
Filesize
232KB
-
Filesize
712KB
-
Filesize
72KB
-
Filesize
5.1MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB