Static task
static1
Behavioral task
behavioral1
Sample
Kosmos.cc.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
Kosmos.cc.exe
Resource
win10v2004-20240221-en
General
-
Target
Kosmos.cc.exe
-
Size
2.5MB
-
MD5
46987adc36cfc77d2998c2241ec6f6c5
-
SHA1
32c3762f44892b6086bc85914e7b6a7def4ef5fd
-
SHA256
70370d2c158b4f0a5d4c91d3b3681a68ea939197ec054ecfb5fbaf115364605c
-
SHA512
18a14852b7bc5d3bb64ab05dd1b47e9f8e6cdeee97147b6cb4e5e240bf93e83ab6af4b16a9c89525d80ca4490a1787884cb589df07ee0e90d64de8702fd1f0e9
-
SSDEEP
49152:6mRB7NITYbNbNWo4kSH3OqtwIrkqXfd+/9ATrgBWBKH8jkDVFCNXODzWS9HfX0H:6+nIT4bNJFY3Oqt3kqXf0F1+KH4kpc+O
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Kosmos.cc.exe
Files
-
Kosmos.cc.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
z]_ Size: 140KB - Virtual size: 140KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
z]_ Size: 140KB - Virtual size: 140KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SC484ES9 Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ