Analysis
- max time kernel
898s - max time network
392s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
23/05/2026, 15:06
General
- Target CyberGhostVPNSetup.exe
- Size 127KB
- Sample260523-sg2bfsd14x
- SHA256 f6dfae75fd23c0446ec1721994cf2530c66bd76366423176414747b39153bf58
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
- Executes dropped EXE 1 IoCs
- Drops file in Program Files directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies system certificate store 2 TTPs 10 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\CyberGhostVPNSetup.exe"C:\Users\Admin\AppData\Local\Temp\CyberGhostVPNSetup.exe"1⤵
- Downloads MZ/PE file
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\f72d01d7-40cd-4b4e-81cf-e9a08721df52\3b0605db-f503-4912-9f9f-f74ec960a5d0.exe"C:\Program Files\f72d01d7-40cd-4b4e-81cf-e9a08721df52\3b0605db-f503-4912-9f9f-f74ec960a5d0.exe" "C:\Users\Admin\AppData\Local\Temp\CyberGhostVPNSetup.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
3b0605db-f503-4912-9f9f-f74ec960a5d0.exe
TmpD387.tmp
memory/3008-0-0x0000000000920000-0x0000000000942000-memory.dmp
memory/3008-1-0x000000001C290000-0x000000001C2A0000-memory.dmp
memory/3008-2-0x000000001D640000-0x000000001D802000-memory.dmp
memory/3008-3-0x000000001DD40000-0x000000001E268000-memory.dmp
memory/3008-4-0x000000001C290000-0x000000001C2A0000-memory.dmp
memory/4584-49-0x000002212AC10000-0x000002212B120000-memory.dmp
memory/4584-50-0x00000221456D0000-0x00000221456E0000-memory.dmp
memory/4584-51-0x00000221455D0000-0x0000022145666000-memory.dmp
memory/4584-52-0x000002212CD70000-0x000002212CD78000-memory.dmp
memory/4584-53-0x000002212CDC0000-0x000002212CDC8000-memory.dmp
memory/4584-54-0x0000022146460000-0x00000221464F4000-memory.dmp
memory/4584-55-0x000002212CD90000-0x000002212CD9A000-memory.dmp
memory/4584-56-0x000002212CDB0000-0x000002212CDBA000-memory.dmp
memory/4584-57-0x00000221464F0000-0x0000022146590000-memory.dmp
memory/4584-58-0x00000221466C0000-0x00000221466DA000-memory.dmp
memory/4584-59-0x00000221466F0000-0x0000022146736000-memory.dmp
memory/4584-60-0x00000221466E0000-0x00000221466EE000-memory.dmp
memory/4584-61-0x00000221468A0000-0x00000221468CA000-memory.dmp
memory/4584-62-0x00000221468D0000-0x00000221468D8000-memory.dmp
memory/4584-63-0x00000221469D0000-0x00000221469D8000-memory.dmp
memory/4584-64-0x0000022146F30000-0x0000022146F38000-memory.dmp
memory/4584-66-0x00000221475D0000-0x00000221475D8000-memory.dmp
memory/4584-65-0x0000022147530000-0x0000022147538000-memory.dmp
memory/4584-68-0x0000022147670000-0x0000022147678000-memory.dmp
memory/4584-67-0x0000022147630000-0x0000022147638000-memory.dmp
memory/4584-70-0x0000022147870000-0x0000022147878000-memory.dmp
memory/4584-69-0x0000022147810000-0x0000022147818000-memory.dmp
memory/4584-71-0x0000022147950000-0x0000022147958000-memory.dmp
memory/4584-72-0x00000221479D0000-0x00000221479D8000-memory.dmp
memory/4584-73-0x0000022147B30000-0x0000022147B46000-memory.dmp
memory/4584-74-0x000002214A110000-0x000002214A118000-memory.dmp
memory/4584-75-0x000002214A120000-0x000002214A128000-memory.dmp
memory/4584-76-0x000002214A1B0000-0x000002214A1E8000-memory.dmp
memory/4584-77-0x000002214A180000-0x000002214A18E000-memory.dmp
memory/4584-78-0x000002214A1F0000-0x000002214A228000-memory.dmp
memory/4584-79-0x000002214C220000-0x000002214C25A000-memory.dmp
memory/4584-90-0x000002214C290000-0x000002214C2B2000-memory.dmp
memory/4584-91-0x000002214A190000-0x000002214A19A000-memory.dmp
memory/4584-92-0x000002214C2C0000-0x000002214C2FA000-memory.dmp
memory/4584-93-0x000002214C300000-0x000002214C3B2000-memory.dmp
memory/4584-94-0x000002214C3B0000-0x000002214C3C2000-memory.dmp
memory/4584-95-0x000002214DB40000-0x000002214E050000-memory.dmp
memory/4584-96-0x00000221456D0000-0x00000221456E0000-memory.dmp
memory/4584-97-0x000002214C740000-0x000002214C7B6000-memory.dmp
memory/4584-98-0x000002214C800000-0x000002214C834000-memory.dmp
memory/4584-99-0x000002214C860000-0x000002214C886000-memory.dmp
memory/4584-100-0x000002214C890000-0x000002214C898000-memory.dmp
memory/4584-102-0x000002214C8A0000-0x000002214C8FA000-memory.dmp
memory/4584-103-0x000002214D720000-0x000002214D734000-memory.dmp
memory/4584-104-0x000002214D640000-0x000002214D64A000-memory.dmp