Analysis
-
max time kernel
150s -
max time network
104s -
platform
windows11-21h2_x64 -
resource
win11-20250508-en -
resource tags
arch:x64arch:x86image:win11-20250508-enlocale:en-usos:windows11-21h2-x64system -
submitted
29/05/2025, 11:56
Static task
static1
Behavioral task
behavioral1
Sample
8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral2
Sample
8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe
Resource
win11-20250508-en
General
-
Target
8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe
-
Size
35KB
-
MD5
87a571e238591e85d55f4d90eee348db
-
SHA1
360f3d92c9b45fa70e37793d43f13b2a73d12d10
-
SHA256
8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f
-
SHA512
51ba61db687669d65722a4e808cdad4dd003565770bb50f5c266abdae9e798c1640bb6068df55d89a3f796fbac60f9bdd5650bbab6d7784c124a1220d445560d
-
SSDEEP
384:hAg+5OCZ4W6/KWLsqmFae+rOAqmFae+rOfijcijK2J7u82J7uFBlB0:uZ4FLz8ae+rOn8ae+rOfXqJ7gJ7ITe
Malware Config
Signatures
-
Cosmu family
-
Detects Cosmu payload 1 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/memory/2104-1137-0x0000000000400000-0x0000000000407000-memory.dmp family_cosmu -
Renames multiple (5332) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.dll.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationClientSideProviders.resources.dll.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Google\Chrome\Application\133.0.6943.60\Locales\lt.pak.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-pl.xrm-ms.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\7-Zip\Lang\be.txt.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationCore.dll.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Java\jre-1.8\bin\vcruntime140.dll.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019DemoR_BypassTrial180-ppd.xrm-ms.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Edit.White.png.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationClient.resources.dll.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Forms.Design.resources.dll.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-100.png.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\7-Zip\7z.exe.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\7-Zip\descript.ion.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.dll.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\libffi.md.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremDemoR_BypassTrial365-ppd.xrm-ms.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Common Files\System\ado\msadrh15.dll.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_KMS_Client-ppd.xrm-ms.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\APPLAUSE.WAV.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.MSOUC.16.1033.hxn.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-cn.dll.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\dynalink.md.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Microsoft Office\root\Office16\Configuration\card_security_terms_dict.txt.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hant\UIAutomationClient.resources.dll.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-processthreads-l1-1-0.dll.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-pl.xrm-ms.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.vsto.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\lcms.md.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Grace-ppd.xrm-ms.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-pl.xrm-ms.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Microsoft Office\root\Office16\ONBttnOL.dll.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Csi.dll.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\7-Zip\Lang\de.txt.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fi-fi.dll.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-math-l1-1-0.dll.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Forms.resources.dll.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\System.Windows.Controls.Ribbon.resources.dll.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-ul-oob.xrm-ms.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTrial-pl.xrm-ms.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Microsoft Office\root\Office16\ExcelCtxUIFormulaBarModel.bin.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.VisualBasic.Core.dll.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationTypes.resources.dll.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ko\UIAutomationTypes.resources.dll.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\nashorn.jar.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-ul-oob.xrm-ms.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-ppd.xrm-ms.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\MLASeventhEditionOfficeOnline.xsl.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Microsoft Office\root\Office16\IEAWSDC.DLL.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\sqloledb.rll.mui.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.IO.UnmanagedMemoryStream.dll.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL054.XML.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL120.XML.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Microsoft Office\root\Office16\pkeyconfig-office.xrm-ms.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Printing.dll.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Java\jdk-1.8\include\jvmticmlr.h.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-80.png.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-moreimages.png.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe File created C:\Program Files\Microsoft Office\root\rsod\officemui.msi.16.en-us.tree.dat.tmp 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe"C:\Users\Admin\AppData\Local\Temp\8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2104
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36KB
MD5285b5ccabc97b6c44482cf1abf8abf4f
SHA18810f1c797daed9817e57dfee2e78c1d2649d072
SHA256740a3d0a3b866416ed25baae07e8efbf2c2235a886cd3c19b69d4b8492ead4a8
SHA51264a8238bf3f9ff3d2d96a9759a03a2f83fa5ce65203e77592fe0808e9163063a84faeef1212ca914cff9618670e16664739f7265cfbcbb696798f565be7836e6
-
Filesize
116KB
MD5533e2be25727e149befefcf3ea0eeea8
SHA1472fcd9e6c77aab9f4f8a04ee5fb8932923a1750
SHA25694521ba766d37ed98da8eafa61607f615f6871a4bece04db1e302ec91e2f575f
SHA512d43c8e3d9281ccd8fbf2459245cb9937d1d2c383fd880393e6243771cb896a137e47c84078b22b9434c44a1548bd9919c2a2948ad310b0ef65c6b3bcb2ab5967