Analysis
-
max time kernel
150s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20250502-en -
resource tags
arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system -
submitted
29/05/2025, 10:04
Static task
static1
Behavioral task
behavioral1
Sample
31636d98b7165702e3bc2cd27ade00eddfc05edb4a7d4a5cc53c13da6ed0658a.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral2
Sample
31636d98b7165702e3bc2cd27ade00eddfc05edb4a7d4a5cc53c13da6ed0658a.exe
Resource
win11-20250502-en
General
-
Target
31636d98b7165702e3bc2cd27ade00eddfc05edb4a7d4a5cc53c13da6ed0658a.exe
-
Size
28KB
-
MD5
99bb589848df9617aad19c224ab538b7
-
SHA1
cc28b66727df82f2297e158012f94b8b18cdc360
-
SHA256
31636d98b7165702e3bc2cd27ade00eddfc05edb4a7d4a5cc53c13da6ed0658a
-
SHA512
cb025f43ed25b5209f125668dc443af56b72b6454f6d2b1dcac4947bd3c9d83ebf73e4bb7b147f149b5b64065470f69d5e53b936ccfa6e6c554eb9dca5c33fe6
-
SSDEEP
768:uZ4FLz8ae+rOn8ae+rOHPRPq+BSBmBCUK9+BSBmBCUK1:uGIIHp1MkPMkU
Malware Config
Signatures
-
Cosmu family
-
Detects Cosmu payload 1 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral1/memory/832-797-0x0000000000400000-0x0000000000407000-memory.dmp family_cosmu -
Renames multiple (5264) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\upe.dll.tmp 31636d98b7165702e3bc2cd27ade00eddfc05edb4a7d4a5cc53c13da6ed0658a.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\vstoee.dll.tmp 31636d98b7165702e3bc2cd27ade00eddfc05edb4a7d4a5cc53c13da6ed0658a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationClient.resources.dll.tmp 31636d98b7165702e3bc2cd27ade00eddfc05edb4a7d4a5cc53c13da6ed0658a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Controls.Ribbon.resources.dll.tmp 31636d98b7165702e3bc2cd27ade00eddfc05edb4a7d4a5cc53c13da6ed0658a.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\server\jvm.dll.tmp 31636d98b7165702e3bc2cd27ade00eddfc05edb4a7d4a5cc53c13da6ed0658a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription3-ul-oob.xrm-ms.tmp 31636d98b7165702e3bc2cd27ade00eddfc05edb4a7d4a5cc53c13da6ed0658a.exe File created C:\Program Files\Microsoft Office\root\rsod\onenote.x-none.msi.16.x-none.boot.tree.dat.tmp 31636d98b7165702e3bc2cd27ade00eddfc05edb4a7d4a5cc53c13da6ed0658a.exe File created C:\Program Files\Common Files\microsoft shared\ink\mshwgst.dll.tmp 31636d98b7165702e3bc2cd27ade00eddfc05edb4a7d4a5cc53c13da6ed0658a.exe File created C:\Program Files\Common Files\System\wab32.dll.tmp 31636d98b7165702e3bc2cd27ade00eddfc05edb4a7d4a5cc53c13da6ed0658a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.dll.tmp 31636d98b7165702e3bc2cd27ade00eddfc05edb4a7d4a5cc53c13da6ed0658a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Expressions.dll.tmp 31636d98b7165702e3bc2cd27ade00eddfc05edb4a7d4a5cc53c13da6ed0658a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Trial-ppd.xrm-ms.tmp 31636d98b7165702e3bc2cd27ade00eddfc05edb4a7d4a5cc53c13da6ed0658a.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pl-pl.dll.tmp 31636d98b7165702e3bc2cd27ade00eddfc05edb4a7d4a5cc53c13da6ed0658a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationClient.resources.dll.tmp 31636d98b7165702e3bc2cd27ade00eddfc05edb4a7d4a5cc53c13da6ed0658a.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe.tmp 31636d98b7165702e3bc2cd27ade00eddfc05edb4a7d4a5cc53c13da6ed0658a.exe File created C:\Program Files\Java\jdk-1.8\README.html.tmp 31636d98b7165702e3bc2cd27ade00eddfc05edb4a7d4a5cc53c13da6ed0658a.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_pt_BR.properties.tmp 31636d98b7165702e3bc2cd27ade00eddfc05edb4a7d4a5cc53c13da6ed0658a.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHLTS.DAT.tmp 31636d98b7165702e3bc2cd27ade00eddfc05edb4a7d4a5cc53c13da6ed0658a.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\PowerPivotExcelClientAddIn.tlb.tmp 31636d98b7165702e3bc2cd27ade00eddfc05edb4a7d4a5cc53c13da6ed0658a.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-100.png.tmp 31636d98b7165702e3bc2cd27ade00eddfc05edb4a7d4a5cc53c13da6ed0658a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe.tmp 31636d98b7165702e3bc2cd27ade00eddfc05edb4a7d4a5cc53c13da6ed0658a.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\colorimaging.md.tmp 31636d98b7165702e3bc2cd27ade00eddfc05edb4a7d4a5cc53c13da6ed0658a.exe File created C:\Program Files\Java\jre-1.8\LICENSE.tmp 31636d98b7165702e3bc2cd27ade00eddfc05edb4a7d4a5cc53c13da6ed0658a.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-100.png.tmp 31636d98b7165702e3bc2cd27ade00eddfc05edb4a7d4a5cc53c13da6ed0658a.exe File created C:\Program Files\Java\jre-1.8\lib\security\java.policy.tmp 31636d98b7165702e3bc2cd27ade00eddfc05edb4a7d4a5cc53c13da6ed0658a.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN103.XML.tmp 31636d98b7165702e3bc2cd27ade00eddfc05edb4a7d4a5cc53c13da6ed0658a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encoding.dll.tmp 31636d98b7165702e3bc2cd27ade00eddfc05edb4a7d4a5cc53c13da6ed0658a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XPath.dll.tmp 31636d98b7165702e3bc2cd27ade00eddfc05edb4a7d4a5cc53c13da6ed0658a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\Microsoft.Win32.Registry.dll.tmp 31636d98b7165702e3bc2cd27ade00eddfc05edb4a7d4a5cc53c13da6ed0658a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.Watcher.dll.tmp 31636d98b7165702e3bc2cd27ade00eddfc05edb4a7d4a5cc53c13da6ed0658a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\ReachFramework.resources.dll.tmp 31636d98b7165702e3bc2cd27ade00eddfc05edb4a7d4a5cc53c13da6ed0658a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pl\UIAutomationTypes.resources.dll.tmp 31636d98b7165702e3bc2cd27ade00eddfc05edb4a7d4a5cc53c13da6ed0658a.exe File created C:\Program Files\Java\jre-1.8\lib\plugin.jar.tmp 31636d98b7165702e3bc2cd27ade00eddfc05edb4a7d4a5cc53c13da6ed0658a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-ppd.xrm-ms.tmp 31636d98b7165702e3bc2cd27ade00eddfc05edb4a7d4a5cc53c13da6ed0658a.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\hive.xsl.tmp 31636d98b7165702e3bc2cd27ade00eddfc05edb4a7d4a5cc53c13da6ed0658a.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL103.XML.tmp 31636d98b7165702e3bc2cd27ade00eddfc05edb4a7d4a5cc53c13da6ed0658a.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\LTSHYPH_ES.LEX.tmp 31636d98b7165702e3bc2cd27ade00eddfc05edb4a7d4a5cc53c13da6ed0658a.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsid.xml.tmp 31636d98b7165702e3bc2cd27ade00eddfc05edb4a7d4a5cc53c13da6ed0658a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ppd.xrm-ms.tmp 31636d98b7165702e3bc2cd27ade00eddfc05edb4a7d4a5cc53c13da6ed0658a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-pl.xrm-ms.tmp 31636d98b7165702e3bc2cd27ade00eddfc05edb4a7d4a5cc53c13da6ed0658a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Forms.resources.dll.tmp 31636d98b7165702e3bc2cd27ade00eddfc05edb4a7d4a5cc53c13da6ed0658a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationTypes.resources.dll.tmp 31636d98b7165702e3bc2cd27ade00eddfc05edb4a7d4a5cc53c13da6ed0658a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Controls.Ribbon.resources.dll.tmp 31636d98b7165702e3bc2cd27ade00eddfc05edb4a7d4a5cc53c13da6ed0658a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Windows.Extensions.dll.tmp 31636d98b7165702e3bc2cd27ade00eddfc05edb4a7d4a5cc53c13da6ed0658a.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml.tmp 31636d98b7165702e3bc2cd27ade00eddfc05edb4a7d4a5cc53c13da6ed0658a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationNative_cor3.dll.tmp 31636d98b7165702e3bc2cd27ade00eddfc05edb4a7d4a5cc53c13da6ed0658a.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe.tmp 31636d98b7165702e3bc2cd27ade00eddfc05edb4a7d4a5cc53c13da6ed0658a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_KMS_Client-ul-oob.xrm-ms.tmp 31636d98b7165702e3bc2cd27ade00eddfc05edb4a7d4a5cc53c13da6ed0658a.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_f7\FA000000007.tmp 31636d98b7165702e3bc2cd27ade00eddfc05edb4a7d4a5cc53c13da6ed0658a.exe File created C:\Program Files\Java\jdk-1.8\include\classfile_constants.h.tmp 31636d98b7165702e3bc2cd27ade00eddfc05edb4a7d4a5cc53c13da6ed0658a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-ul-oob.xrm-ms.tmp 31636d98b7165702e3bc2cd27ade00eddfc05edb4a7d4a5cc53c13da6ed0658a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ppd.xrm-ms.tmp 31636d98b7165702e3bc2cd27ade00eddfc05edb4a7d4a5cc53c13da6ed0658a.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\PLANNERS.ONE.tmp 31636d98b7165702e3bc2cd27ade00eddfc05edb4a7d4a5cc53c13da6ed0658a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.Dataflow.dll.tmp 31636d98b7165702e3bc2cd27ade00eddfc05edb4a7d4a5cc53c13da6ed0658a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Memory.dll.tmp 31636d98b7165702e3bc2cd27ade00eddfc05edb4a7d4a5cc53c13da6ed0658a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\System.Windows.Forms.Design.resources.dll.tmp 31636d98b7165702e3bc2cd27ade00eddfc05edb4a7d4a5cc53c13da6ed0658a.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-string-l1-1-0.dll.tmp 31636d98b7165702e3bc2cd27ade00eddfc05edb4a7d4a5cc53c13da6ed0658a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_OEM_Perp-ul-phn.xrm-ms.tmp 31636d98b7165702e3bc2cd27ade00eddfc05edb4a7d4a5cc53c13da6ed0658a.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\glib.md.tmp 31636d98b7165702e3bc2cd27ade00eddfc05edb4a7d4a5cc53c13da6ed0658a.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-ppd.xrm-ms.tmp 31636d98b7165702e3bc2cd27ade00eddfc05edb4a7d4a5cc53c13da6ed0658a.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.dll.tmp 31636d98b7165702e3bc2cd27ade00eddfc05edb4a7d4a5cc53c13da6ed0658a.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN090.XML.tmp 31636d98b7165702e3bc2cd27ade00eddfc05edb4a7d4a5cc53c13da6ed0658a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-processthreads-l1-1-0.dll.tmp 31636d98b7165702e3bc2cd27ade00eddfc05edb4a7d4a5cc53c13da6ed0658a.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.dll.tmp 31636d98b7165702e3bc2cd27ade00eddfc05edb4a7d4a5cc53c13da6ed0658a.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 31636d98b7165702e3bc2cd27ade00eddfc05edb4a7d4a5cc53c13da6ed0658a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\31636d98b7165702e3bc2cd27ade00eddfc05edb4a7d4a5cc53c13da6ed0658a.exe"C:\Users\Admin\AppData\Local\Temp\31636d98b7165702e3bc2cd27ade00eddfc05edb4a7d4a5cc53c13da6ed0658a.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:832
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
MD5528a3278a1cdda12deb5bc2fdef6e7d1
SHA104673aaab703fbe71e21487bca9efcfcca331137
SHA256e47d82bbbe32ca280971a4656e4e54cf0400e4b3ddbd367d98a848abf53f034f
SHA512da3450e7fb9a136467d46f5b374ef02272ffff617ee76ec3b7d0b597a242144e56d62c6064b0c2b88e2391df5d58490c61d9cf3ec74a98b35026185531a96921
-
Filesize
114KB
MD5da096550df89421a7057690659702a45
SHA125a0d78ee336b1b16f7ef08fd18772c77d5107d0
SHA256f9241c6afdc72d7cf559e348350158c1d8616f7f68aad1742e795a5c3a6e1e99
SHA512f46a44498bfe036a4184b06ab0c1e4413b1b1dc2ab89ea802f90fa07ed21d918b50eb967d472b89b31eec784b36e9d70d87b5c6f42cb946cbf315ff4bd9ec85b