Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20250502-en -
resource tags
arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system -
submitted
29/05/2025, 11:56
Static task
static1
Behavioral task
behavioral1
Sample
8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral2
Sample
8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe
Resource
win11-20250508-en
General
-
Target
8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe
-
Size
35KB
-
MD5
87a571e238591e85d55f4d90eee348db
-
SHA1
360f3d92c9b45fa70e37793d43f13b2a73d12d10
-
SHA256
8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f
-
SHA512
51ba61db687669d65722a4e808cdad4dd003565770bb50f5c266abdae9e798c1640bb6068df55d89a3f796fbac60f9bdd5650bbab6d7784c124a1220d445560d
-
SSDEEP
384:hAg+5OCZ4W6/KWLsqmFae+rOAqmFae+rOfijcijK2J7u82J7uFBlB0:uZ4FLz8ae+rOn8ae+rOfXqJ7gJ7ITe
Malware Config
Signatures
-
Cosmu family
-
Detects Cosmu payload 1 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral1/memory/1596-799-0x0000000000400000-0x0000000000407000-memory.dmp family_cosmu -
Renames multiple (5207) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-ppd.xrm-ms.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Concurrent.dll.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationTypes.resources.dll.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\CASHREG.WAV.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\tr\PresentationUI.resources.dll.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Google\Chrome\Application\133.0.6943.60\VisualElements\LogoDev.png.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntry2019R_PrepidBypass-ul-oob.xrm-ms.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-140.png.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Microsoft Office\root\Office16\msix.dll.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Forms.Design.resources.dll.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hant\UIAutomationClient.resources.dll.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Google\Chrome\Application\133.0.6943.60\chrome.dll.sig.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ppd.xrm-ms.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ppd.xrm-ms.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOCR.DLL.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Microsoft Office\root\Office16\PPSLAX.DLL.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Common Files\System\ado\msadox28.tlb.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Common Files\System\Ole DB\msxactps.dll.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\thaidict.md.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ppd.xrm-ms.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_profile.png.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN111.XML.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Formatters.dll.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\PresentationUI.resources.dll.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_K_COL.HXK.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\CancelFluent.png.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipschs.xml.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Common Files\microsoft shared\ink\nl-NL\tipresx.dll.mui.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.Win32.Primitives.dll.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Controls.Ribbon.resources.dll.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTrial-ul-oob.xrm-ms.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_COL.HXC.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL116.XML.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\StoreLogo.png.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\msinfo32.exe.mui.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Immutable.dll.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Forms.resources.dll.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-convert-l1-1-0.dll.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Organic.thmx.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\FUNCRES.XLAM.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Forms.resources.dll.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationTypes.resources.dll.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.NameResolution.dll.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\server\Xusage.txt.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Gothic-Palatino Linotype.xml.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-ul-phn.xrm-ms.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Google\Chrome\Application\133.0.6943.60\Locales\hu.pak.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Java\jre-1.8\bin\sspi_bridge.dll.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\CERTINTL.DLL.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.ProgressiveProcessing.dll.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\CalibriL.ttf.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clretwrc.dll.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Linq.Parallel.dll.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jsdt.dll.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Common Files\System\msadc\msdfmap.dll.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-ppd.xrm-ms.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Forms.resources.dll.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe"C:\Users\Admin\AppData\Local\Temp\8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1596
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36KB
MD5898489f84a8a186209888f6004475002
SHA10119ee430ad48d6dc468ebbfabd1d1c8306192aa
SHA2569d2ef967a594f8ec4fd04fdee0ab444d7ee1da1b39b8cb416f78f8a24eb78303
SHA512f6556df7a1ebc2d1039acba64f629f19145d48ace4c5d54ffe1d24b68ecdce33865bed017a481ff58b043cbac7f3c2c1c2c201d632c179065812d5f55a57b1a4
-
Filesize
121KB
MD59d31f6f7cbeb2f0716cf0440938ded12
SHA17d41764c24f9ce49934712beb0650991d38ba82d
SHA256282dc2a4c7bb1043ac876d2da660383d7e6be3b28f9f61d7c1e8747bde688c7d
SHA5128f267b401a48ed1931d376b2ed772cd003c363ee0808f69c449454123c87cdd2e711b56ba2fb11ae1809935dd0cbc7b3c115972537dce502657c73fddd1074d7