Analysis
- max time kernel
900s - max time network
465s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
30/09/2026, 12:22
General
- Target CyberGhostVPNSetup.exe
- Size 127KB
- Sample260930-pjw8qsfa47
- SHA256 f6dfae75fd23c0446ec1721994cf2530c66bd76366423176414747b39153bf58
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
- Executes dropped EXE 1 IoCs
- Drops file in Program Files directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Modifies system certificate store 2 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\CyberGhostVPNSetup.exe"C:\Users\Admin\AppData\Local\Temp\CyberGhostVPNSetup.exe"1⤵
- Downloads MZ/PE file
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\fc2d736b-a4fc-445a-a98d-8fb08f1faf54\d5d43fba-ae54-4622-ba4b-9690920dd77b.exe"C:\Program Files\fc2d736b-a4fc-445a-a98d-8fb08f1faf54\d5d43fba-ae54-4622-ba4b-9690920dd77b.exe" "C:\Users\Admin\AppData\Local\Temp\CyberGhostVPNSetup.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
d5d43fba-ae54-4622-ba4b-9690920dd77b.exe
18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB
AEACCDA8653DD8D7B2EA32F21D15D44F_46E4040B4A28D439FBFA7E9FC642442C
B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB
AEACCDA8653DD8D7B2EA32F21D15D44F_46E4040B4A28D439FBFA7E9FC642442C
B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
Tmp8B4E.tmp
memory/3180-83-0x0000028C37B00000-0x0000028C37B08000-memory.dmp
memory/3180-98-0x0000028C3B220000-0x0000028C3B258000-memory.dmp
memory/3180-124-0x00007FFA544B0000-0x00007FFA54E54000-memory.dmp
memory/3180-123-0x0000028C3CD80000-0x0000028C3CDAD000-memory.dmp
memory/3180-85-0x0000028C38660000-0x0000028C38668000-memory.dmp
memory/3180-56-0x0000028C1C060000-0x0000028C1C570000-memory.dmp
memory/3180-57-0x00007FFA544B0000-0x00007FFA54E54000-memory.dmp
memory/3180-62-0x0000028C1E400000-0x0000028C1E408000-memory.dmp
memory/3180-63-0x00007FFA544B0000-0x00007FFA54E54000-memory.dmp
memory/3180-64-0x0000028C36AE0000-0x0000028C36B74000-memory.dmp
memory/3180-67-0x00007FFA544B0000-0x00007FFA54E54000-memory.dmp
memory/3180-65-0x0000028C1E3E0000-0x0000028C1E3EA000-memory.dmp
memory/3180-66-0x0000028C36BD0000-0x0000028C36BDA000-memory.dmp
memory/3180-68-0x00007FFA544B0000-0x00007FFA54E54000-memory.dmp
memory/3180-61-0x0000028C1E1F0000-0x0000028C1E1F8000-memory.dmp
memory/3180-60-0x0000028C1E330000-0x0000028C1E3C6000-memory.dmp
memory/3180-69-0x0000028C36D60000-0x0000028C36E00000-memory.dmp
memory/3180-70-0x00007FFA544B0000-0x00007FFA54E54000-memory.dmp
memory/3180-72-0x0000028C37820000-0x0000028C37866000-memory.dmp
memory/3180-73-0x00007FFA544B0000-0x00007FFA54E54000-memory.dmp
memory/3180-71-0x0000028C37800000-0x0000028C3781A000-memory.dmp
memory/3180-74-0x00007FFA544B0000-0x00007FFA54E54000-memory.dmp
memory/3180-75-0x00007FFA544B0000-0x00007FFA54E54000-memory.dmp
memory/3180-77-0x00007FFA544B0000-0x00007FFA54E54000-memory.dmp
memory/3180-78-0x0000028C379D0000-0x0000028C379FA000-memory.dmp
memory/3180-76-0x0000028C36C40000-0x0000028C36C4E000-memory.dmp
memory/3180-79-0x00007FFA544B0000-0x00007FFA54E54000-memory.dmp
memory/3180-80-0x00007FFA544B0000-0x00007FFA54E54000-memory.dmp
memory/3180-81-0x0000028C37A00000-0x0000028C37A08000-memory.dmp
memory/3180-82-0x00007FFA544B0000-0x00007FFA54E54000-memory.dmp
memory/3180-58-0x00007FFA544B0000-0x00007FFA54E54000-memory.dmp
memory/3180-84-0x0000028C38060000-0x0000028C38068000-memory.dmp
memory/3180-59-0x00007FFA544B0000-0x00007FFA54E54000-memory.dmp
memory/3180-90-0x0000028C389A0000-0x0000028C389A8000-memory.dmp
memory/3180-88-0x0000028C387A0000-0x0000028C387A8000-memory.dmp
memory/3180-86-0x0000028C38700000-0x0000028C38708000-memory.dmp
memory/3180-89-0x0000028C38940000-0x0000028C38948000-memory.dmp
memory/3180-91-0x0000028C38A80000-0x0000028C38A88000-memory.dmp
memory/3180-92-0x0000028C38B00000-0x0000028C38B08000-memory.dmp
memory/3180-87-0x0000028C38760000-0x0000028C38768000-memory.dmp
memory/3180-93-0x0000028C38B60000-0x0000028C38B76000-memory.dmp
memory/3180-94-0x0000028C3B140000-0x0000028C3B148000-memory.dmp
memory/3180-95-0x0000028C3B150000-0x0000028C3B158000-memory.dmp
memory/3180-96-0x0000028C3B1E0000-0x0000028C3B21E000-memory.dmp
memory/3180-97-0x0000028C3B1B0000-0x0000028C3B1BE000-memory.dmp
memory/3180-99-0x0000028C3C8A0000-0x0000028C3C8DA000-memory.dmp
memory/3180-114-0x0000028C3CA30000-0x0000028C3CA42000-memory.dmp
memory/3180-110-0x0000028C3C910000-0x0000028C3C932000-memory.dmp
memory/3180-111-0x0000028C3B1C0000-0x0000028C3B1CA000-memory.dmp
memory/3180-112-0x0000028C3C940000-0x0000028C3C97A000-memory.dmp
memory/3180-113-0x0000028C3C980000-0x0000028C3CA32000-memory.dmp
memory/4792-1-0x0000000000960000-0x0000000000982000-memory.dmp
memory/4792-116-0x00007FFA544B0000-0x00007FFA54E54000-memory.dmp
memory/4792-10-0x00007FFA544B0000-0x00007FFA54E54000-memory.dmp
memory/4792-11-0x00007FFA544B0000-0x00007FFA54E54000-memory.dmp
memory/4792-12-0x00007FFA544B0000-0x00007FFA54E54000-memory.dmp
memory/4792-13-0x00007FFA544B0000-0x00007FFA54E54000-memory.dmp
memory/4792-14-0x00007FFA544B0000-0x00007FFA54E54000-memory.dmp
memory/4792-4-0x000000001CAB0000-0x000000001CC72000-memory.dmp
memory/4792-2-0x00007FFA544B0000-0x00007FFA54E54000-memory.dmp
memory/4792-0-0x00007FFA5463F000-0x00007FFA54640000-memory.dmp
memory/4792-115-0x000000001CA70000-0x000000001CA9D000-memory.dmp
memory/4792-7-0x00007FFA544B0000-0x00007FFA54E54000-memory.dmp
memory/4792-3-0x00007FFA544B0000-0x00007FFA54E54000-memory.dmp
memory/4792-9-0x00007FFA544B0000-0x00007FFA54E54000-memory.dmp
memory/4792-8-0x00007FFA544B0000-0x00007FFA54E54000-memory.dmp
memory/4792-6-0x00007FFA544B0000-0x00007FFA54E54000-memory.dmp
memory/4792-5-0x000000001D1B0000-0x000000001D6D8000-memory.dmp