Analysis

  • max time kernel
    150s
  • max time network
    104s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250508-en
  • resource tags

    arch:x64arch:x86image:win11-20250508-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    29/05/2025, 11:56

General

  • Target

    8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe

  • Size

    35KB

  • MD5

    87a571e238591e85d55f4d90eee348db

  • SHA1

    360f3d92c9b45fa70e37793d43f13b2a73d12d10

  • SHA256

    8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f

  • SHA512

    51ba61db687669d65722a4e808cdad4dd003565770bb50f5c266abdae9e798c1640bb6068df55d89a3f796fbac60f9bdd5650bbab6d7784c124a1220d445560d

  • SSDEEP

    384:hAg+5OCZ4W6/KWLsqmFae+rOAqmFae+rOfijcijK2J7u82J7uFBlB0:uZ4FLz8ae+rOn8ae+rOfXqJ7gJ7ITe

Malware Config

Signatures

  • Cosmu

    Cosmu is a Windows worm written in C++.

  • Cosmu family
  • Detects Cosmu payload 1 IoCs

    Cosmu is a worm written in C++.

  • Renames multiple (5332) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe
    "C:\Users\Admin\AppData\Local\Temp\8a6bfb209fd6d7f9544561a2c6e6c7eebf7c5fdd69ccd61016d510337abeb87f.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2104

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\$Recycle.Bin\S-1-5-21-3687046934-3833731302-526866946-1000\desktop.ini.tmp

          Filesize

          36KB

          MD5

          285b5ccabc97b6c44482cf1abf8abf4f

          SHA1

          8810f1c797daed9817e57dfee2e78c1d2649d072

          SHA256

          740a3d0a3b866416ed25baae07e8efbf2c2235a886cd3c19b69d4b8492ead4a8

          SHA512

          64a8238bf3f9ff3d2d96a9759a03a2f83fa5ce65203e77592fe0808e9163063a84faeef1212ca914cff9618670e16664739f7265cfbcbb696798f565be7836e6

        • C:\b9147e4cea9b95b6635d\2010_x86.log.html.tmp

          Filesize

          116KB

          MD5

          533e2be25727e149befefcf3ea0eeea8

          SHA1

          472fcd9e6c77aab9f4f8a04ee5fb8932923a1750

          SHA256

          94521ba766d37ed98da8eafa61607f615f6871a4bece04db1e302ec91e2f575f

          SHA512

          d43c8e3d9281ccd8fbf2459245cb9937d1d2c383fd880393e6243771cb896a137e47c84078b22b9434c44a1548bd9919c2a2948ad310b0ef65c6b3bcb2ab5967

        • memory/2104-1137-0x0000000000400000-0x0000000000407000-memory.dmp

          Filesize

          28KB