Analysis
-
max time kernel
103s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20250502-en -
resource tags
arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system -
submitted
05/06/2025, 07:27
Static task
static1
1 signatures
General
-
Target
de224f0590c95b4a3f117fbb5342133717b2e62e3d63bb530d7aa4826b352a0c.exe
-
Size
1.1MB
-
MD5
53fbd0f39af157f9f24364d8ed1174ff
-
SHA1
50c4cc70954786e39c8e02c89934033eb15fabfb
-
SHA256
de224f0590c95b4a3f117fbb5342133717b2e62e3d63bb530d7aa4826b352a0c
-
SHA512
8ef62e7445046ca7dffd6ae3e00a807c167adbb2b112e9a6cf8e19bc187fdff5e6807e7b1b7e22b85fba03e06257b512d61c52d699a81c062def473c3c09f436
-
SSDEEP
24576:LlYvh+CX4vqEdr5UtOylFaCykBG3oXRK4:i0CoBR4
Malware Config
Signatures
-
Cosmu family
-
Detects Cosmu payload 1 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral1/memory/2060-0-0x0000000000400000-0x0000000000407000-memory.dmp family_cosmu -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language de224f0590c95b4a3f117fbb5342133717b2e62e3d63bb530d7aa4826b352a0c.exe