cosmu | adf980b10a38c4b4ad5d9c483e14250d3b56fd9927db903cfc53f3fc7b11b813

Analysis

max time kernel
101s
max time network
110s
platform
windows11-21h2_x64
resource
win11-20250502-en
resource tags

arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system
submitted
29/05/2025, 01:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
adf980b10a38c4b4ad5d9c483e14250d3b56fd9927db903cfc53f3fc7b11b813.exe
Size 36KB
Sample250529-bmdc5swlv4
SHA256 adf980b10a38c4b4ad5d9c483e14250d3b56fd9927db903cfc53f3fc7b11b813
MD5 e4cde78c698cc7fa3578d17b9de55b7f
SHA1 cd5bb38f7c0e682414f1ef1ccbfa988d60e1354c
SHA512 f74529415cce961b14c32dc850021c5ed169b155a1c337b2d6b657d749adb72f0a8c09fb1ad8c57e4f1f59d92be94b0a1753ef7712f2b4b15629bc9ae8275858
SSDEEP 768:uZ4FLz8ae+rOn8ae+rOrZkZ/7GoMGKEoMGKe:uGII1GCoM4oMS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cosmu discovery worm

Malware Config

Signatures

Cosmu
Cosmu is a Windows worm written in C++.
worm cosmu
Cosmu family
cosmu

Detects Cosmu payload 1 IoCs

Cosmu is a worm written in C++.

resource	yara_rule
behavioral2/memory/4492-0-0x0000000000400000-0x0000000000407000-memory.dmp	family_cosmu

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adf980b10a38c4b4ad5d9c483e14250d3b56fd9927db903cfc53f3fc7b11b813.exe

C:\Users\Admin\AppData\Local\Temp\adf980b10a38c4b4ad5d9c483e14250d3b56fd9927db903cfc53f3fc7b11b813.exe
"C:\Users\Admin\AppData\Local\Temp\adf980b10a38c4b4ad5d9c483e14250d3b56fd9927db903cfc53f3fc7b11b813.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4492-0-0x0000000000400000-0x0000000000407000-memory.dmp

Download