Analysis
- max time kernel
150s - max time network
104s - platform
windows11-21h2_x64 - resource
win11-20250502-en - resource tags
arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system - submitted
28/05/2025, 09:36
Behavioral task
behavioral1
Sample
835d58b796276c852775967e6c196a5c1a7cb2f1d8dee8724638a4482571148c.exe
Resource
win10v2004-20250502-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
835d58b796276c852775967e6c196a5c1a7cb2f1d8dee8724638a4482571148c.exe
Resource
win11-20250502-en
windows11-21h2-x64
6 signatures
150 seconds
General
- Target 835d58b796276c852775967e6c196a5c1a7cb2f1d8dee8724638a4482571148c.exe
- Size 26KB
- Sample250528-lk437avpy8
- SHA256 835d58b796276c852775967e6c196a5c1a7cb2f1d8dee8724638a4482571148c
- MD5 124d0dbe4cc2859afba53693b3a250a9
- SHA1 ed96084d946de772cccf38199beaddde58df1a96
- SHA512 c00d25cc731739c0278f2017a6c7e4d1c0b6ef2cb5cb31aeb1cef97b213ca27ea4c82c2e80bbeefd6e0a3a936516592a31cc2fb40f5cf214c6bc3c2a83779e82
- SSDEEP 768:s7BlpppARFbhdLz8ae+rOn8ae+rOsTazTac:s7ZppApdIIsTITZ
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Cosmu family
- Detects Cosmu payload 2 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000d00000002ad93-1.dat family_cosmu behavioral2/files/0x00040000000270d9-5.dat family_cosmu - Renames multiple (5371) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-ul-oob.xrm-ms.tmp 835d58b796276c852775967e6c196a5c1a7cb2f1d8dee8724638a4482571148c.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Tracing.dll.tmp 835d58b796276c852775967e6c196a5c1a7cb2f1d8dee8724638a4482571148c.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 835d58b796276c852775967e6c196a5c1a7cb2f1d8dee8724638a4482571148c.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\RedAndBlackReport.dotx.tmp 835d58b796276c852775967e6c196a5c1a7cb2f1d8dee8724638a4482571148c.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Input.Manipulations.resources.dll.tmp 835d58b796276c852775967e6c196a5c1a7cb2f1d8dee8724638a4482571148c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_Subscription-pl.xrm-ms.tmp 835d58b796276c852775967e6c196a5c1a7cb2f1d8dee8724638a4482571148c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-pl.xrm-ms.tmp 835d58b796276c852775967e6c196a5c1a7cb2f1d8dee8724638a4482571148c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-ppd.xrm-ms.tmp 835d58b796276c852775967e6c196a5c1a7cb2f1d8dee8724638a4482571148c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_Grace-ul-oob.xrm-ms.tmp 835d58b796276c852775967e6c196a5c1a7cb2f1d8dee8724638a4482571148c.exe File created C:\Program Files\Microsoft Office\root\Office16\ChakraCore.Debugger.dll.tmp 835d58b796276c852775967e6c196a5c1a7cb2f1d8dee8724638a4482571148c.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Resources.ResourceManager.dll.tmp 835d58b796276c852775967e6c196a5c1a7cb2f1d8dee8724638a4482571148c.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\ReachFramework.resources.dll.tmp 835d58b796276c852775967e6c196a5c1a7cb2f1d8dee8724638a4482571148c.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp 835d58b796276c852775967e6c196a5c1a7cb2f1d8dee8724638a4482571148c.exe File created C:\Program Files\Google\Chrome\Application\133.0.6943.60\VisualElements\LogoDev.png.tmp 835d58b796276c852775967e6c196a5c1a7cb2f1d8dee8724638a4482571148c.exe File created C:\Program Files\Common Files\System\Ole DB\sqloledb.rll.tmp 835d58b796276c852775967e6c196a5c1a7cb2f1d8dee8724638a4482571148c.exe File created C:\Program Files\Google\Chrome\Application\133.0.6943.60\Locales\sr.pak.tmp 835d58b796276c852775967e6c196a5c1a7cb2f1d8dee8724638a4482571148c.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Reflection.eftx.tmp 835d58b796276c852775967e6c196a5c1a7cb2f1d8dee8724638a4482571148c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\pkeyconfig-office-client15.xrm-ms.tmp 835d58b796276c852775967e6c196a5c1a7cb2f1d8dee8724638a4482571148c.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.OAuth.dll.tmp 835d58b796276c852775967e6c196a5c1a7cb2f1d8dee8724638a4482571148c.exe File created C:\Program Files\Microsoft Office\root\Office16\mip_clienttelemetry.dll.tmp 835d58b796276c852775967e6c196a5c1a7cb2f1d8dee8724638a4482571148c.exe File created C:\Program Files\Common Files\System\ado\msadox.dll.tmp 835d58b796276c852775967e6c196a5c1a7cb2f1d8dee8724638a4482571148c.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.ZipFile.dll.tmp 835d58b796276c852775967e6c196a5c1a7cb2f1d8dee8724638a4482571148c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Grace-ppd.xrm-ms.tmp 835d58b796276c852775967e6c196a5c1a7cb2f1d8dee8724638a4482571148c.exe File created C:\Program Files\7-Zip\Uninstall.exe.tmp 835d58b796276c852775967e6c196a5c1a7cb2f1d8dee8724638a4482571148c.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationCore.resources.dll.tmp 835d58b796276c852775967e6c196a5c1a7cb2f1d8dee8724638a4482571148c.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\es\PresentationUI.resources.dll.tmp 835d58b796276c852775967e6c196a5c1a7cb2f1d8dee8724638a4482571148c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ppd.xrm-ms.tmp 835d58b796276c852775967e6c196a5c1a7cb2f1d8dee8724638a4482571148c.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PowerPointNaiveBayesCommandRanker.txt.tmp 835d58b796276c852775967e6c196a5c1a7cb2f1d8dee8724638a4482571148c.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_w1\WA104381125.tmp 835d58b796276c852775967e6c196a5c1a7cb2f1d8dee8724638a4482571148c.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.tmp 835d58b796276c852775967e6c196a5c1a7cb2f1d8dee8724638a4482571148c.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebProxy.dll.tmp 835d58b796276c852775967e6c196a5c1a7cb2f1d8dee8724638a4482571148c.exe File created C:\Program Files\Java\jdk-1.8\include\jvmti.h.tmp 835d58b796276c852775967e6c196a5c1a7cb2f1d8dee8724638a4482571148c.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-string-l1-1-0.dll.tmp 835d58b796276c852775967e6c196a5c1a7cb2f1d8dee8724638a4482571148c.exe File created C:\Program Files\Java\jre-1.8\lib\ext\dnsns.jar.tmp 835d58b796276c852775967e6c196a5c1a7cb2f1d8dee8724638a4482571148c.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Violet II.xml.tmp 835d58b796276c852775967e6c196a5c1a7cb2f1d8dee8724638a4482571148c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-ppd.xrm-ms.tmp 835d58b796276c852775967e6c196a5c1a7cb2f1d8dee8724638a4482571148c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ul-phn.xrm-ms.tmp 835d58b796276c852775967e6c196a5c1a7cb2f1d8dee8724638a4482571148c.exe File created C:\Program Files\Common Files\System\ja-JP\wab32res.dll.mui.tmp 835d58b796276c852775967e6c196a5c1a7cb2f1d8dee8724638a4482571148c.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Ping.dll.tmp 835d58b796276c852775967e6c196a5c1a7cb2f1d8dee8724638a4482571148c.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\wpfgfx_cor3.dll.tmp 835d58b796276c852775967e6c196a5c1a7cb2f1d8dee8724638a4482571148c.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hans\System.Windows.Forms.Primitives.resources.dll.tmp 835d58b796276c852775967e6c196a5c1a7cb2f1d8dee8724638a4482571148c.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\pkcs11wrapper.md.tmp 835d58b796276c852775967e6c196a5c1a7cb2f1d8dee8724638a4482571148c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Trial-ppd.xrm-ms.tmp 835d58b796276c852775967e6c196a5c1a7cb2f1d8dee8724638a4482571148c.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_F_COL.HXK.tmp 835d58b796276c852775967e6c196a5c1a7cb2f1d8dee8724638a4482571148c.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_COL.HXT.tmp 835d58b796276c852775967e6c196a5c1a7cb2f1d8dee8724638a4482571148c.exe File created C:\Program Files\Common Files\System\ado\msader15.dll.tmp 835d58b796276c852775967e6c196a5c1a7cb2f1d8dee8724638a4482571148c.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\PresentationFramework.resources.dll.tmp 835d58b796276c852775967e6c196a5c1a7cb2f1d8dee8724638a4482571148c.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\dt_socket.dll.tmp 835d58b796276c852775967e6c196a5c1a7cb2f1d8dee8724638a4482571148c.exe File created C:\Program Files\Java\jre-1.8\bin\unpack.dll.tmp 835d58b796276c852775967e6c196a5c1a7cb2f1d8dee8724638a4482571148c.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Security.Principal.dll.tmp 835d58b796276c852775967e6c196a5c1a7cb2f1d8dee8724638a4482571148c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-pl.xrm-ms.tmp 835d58b796276c852775967e6c196a5c1a7cb2f1d8dee8724638a4482571148c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-pl.xrm-ms.tmp 835d58b796276c852775967e6c196a5c1a7cb2f1d8dee8724638a4482571148c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-pl.xrm-ms.tmp 835d58b796276c852775967e6c196a5c1a7cb2f1d8dee8724638a4482571148c.exe File created C:\Program Files\Microsoft Office\root\Office16\VISSHE.DLL.tmp 835d58b796276c852775967e6c196a5c1a7cb2f1d8dee8724638a4482571148c.exe File created C:\Program Files\Microsoft Office\root\Client\C2R64.dll.tmp 835d58b796276c852775967e6c196a5c1a7cb2f1d8dee8724638a4482571148c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp 835d58b796276c852775967e6c196a5c1a7cb2f1d8dee8724638a4482571148c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_KMS_Client-ppd.xrm-ms.tmp 835d58b796276c852775967e6c196a5c1a7cb2f1d8dee8724638a4482571148c.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE.tmp 835d58b796276c852775967e6c196a5c1a7cb2f1d8dee8724638a4482571148c.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 835d58b796276c852775967e6c196a5c1a7cb2f1d8dee8724638a4482571148c.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE.tmp 835d58b796276c852775967e6c196a5c1a7cb2f1d8dee8724638a4482571148c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProDemoR_BypassTrial180-ppd.xrm-ms.tmp 835d58b796276c852775967e6c196a5c1a7cb2f1d8dee8724638a4482571148c.exe File created C:\Program Files\AssertAdd.rtf.tmp 835d58b796276c852775967e6c196a5c1a7cb2f1d8dee8724638a4482571148c.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.Primitives.resources.dll.tmp 835d58b796276c852775967e6c196a5c1a7cb2f1d8dee8724638a4482571148c.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Resources.Extensions.dll.tmp 835d58b796276c852775967e6c196a5c1a7cb2f1d8dee8724638a4482571148c.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 835d58b796276c852775967e6c196a5c1a7cb2f1d8dee8724638a4482571148c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\835d58b796276c852775967e6c196a5c1a7cb2f1d8dee8724638a4482571148c.exe"C:\Users\Admin\AppData\Local\Temp\835d58b796276c852775967e6c196a5c1a7cb2f1d8dee8724638a4482571148c.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4884
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-330179853-1108322181-418488014-1000\desktop.ini.tmp
- Size 27KB
- SHA256 4501c79ecf3663ab72c6cda84347939c6b811bd0ee6b5aeab688ab1a45dca782
- MD5 62706f2c0adb3d50a32875f09961981c
- SHA1 40ea5013a0838d8c335119de16ae4d2673a53e8b
- SHA512 b1aa00d0e53ee431aba47b5edfa6f14b6a80fa4daa93e9fbbbfb05e715e486343c4f2a930931b055d8610ce56b21a308a6043822efc0991c483fdcbef2ef2751
- SSDEEP 768:s7BlpppARFbhdLz8ae+rOn8ae+rOsTazTaO:s7ZppApdIIsTITb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\b5678467481f56688dc2ce816954\2010_x86.log.html.tmp
- Size 107KB
- SHA256 4baef0ff20642e86e9d22474a3b1cdf0980c293833ff4807441abd69df1cd013
- MD5 50dfc234797ed2d4d41c30fddb5334a2
- SHA1 93c0e7dd76b45337b527ed0833791f895161256a
- SHA512 65e06568414bc8cffe2bb768be0a4635751acab1d59bd9e70c5b9f48cdc2938b909ede63bf430ac75416c76a6a84cd18b0d22cf4d9230cb739656dd3ffed56ad
- SSDEEP 768:s7BlpppARFbhdLz8ae+rOn8ae+rOsTazTa4Vyw7oLAlqVf5oPti/T1b:s7ZppApdIIsTIThoslqVf5oPti/1
- MD5 SHA1 SHA512 SSDEEP