Analysis

  • max time kernel
    150s
  • max time network
    134s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250502-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/06/2025, 07:27

General

  • Target

    c9fda8aa3ced28ab18a3f40aa30b85968d3261e1b7ab6316680770420ee17d84.exe

  • Size

    25KB

  • MD5

    1cf41b445e911cbb2b7e2bb63a3b8e2d

  • SHA1

    d7fe74e6682458f8251deab4259c359fc88ded76

  • SHA256

    c9fda8aa3ced28ab18a3f40aa30b85968d3261e1b7ab6316680770420ee17d84

  • SHA512

    1de7e1d3112f849d057a151fbc605c1e7d8679c77273a67d55980f22aab00ac9d71a5bfebeda2e82b18d81b4c17fbab7654b99d2faec2a7f093044648e3eca50

  • SSDEEP

    384:gBt7Br5xjL9AgA71FbhvP/KWLsqmFae+rOAqmFae+rOr9NNV5H/V36ac:s7BlpppARFbhdLz8ae+rOn8ae+rO2ac

Malware Config

Signatures

  • Cosmu

    Cosmu is a Windows worm written in C++.

  • Cosmu family
  • Detects Cosmu payload 2 IoCs

    Cosmu is a worm written in C++.

  • Renames multiple (5157) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\c9fda8aa3ced28ab18a3f40aa30b85968d3261e1b7ab6316680770420ee17d84.exe
    "C:\Users\Admin\AppData\Local\Temp\c9fda8aa3ced28ab18a3f40aa30b85968d3261e1b7ab6316680770420ee17d84.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:4284

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\$Recycle.Bin\S-1-5-21-2930597513-779029253-718817275-1000\desktop.ini.tmp

          Filesize

          25KB

          MD5

          3e5118009fd42e047a35cf7fe53ea521

          SHA1

          5a461f9961978081e82ff1329498f5773c4675e7

          SHA256

          38deec03f58ffcd72cea768d4493deb771397a6bdf223a306e9b81bf3399167e

          SHA512

          5247db663c40c9dc199f33c99a750f4580bdc5f6ea57a7c5fc380271b060fc3186aa0912d0c16d2adadadefc0c948d9aa3065f1b4a5bac663e9a2accec5678df

        • C:\6479eedf55783993fe56765264\2010_x86.log.html.tmp

          Filesize

          106KB

          MD5

          e03c9b613ab9ee83d6bf95e23709662b

          SHA1

          c7c039803c70cdb818624eba1525f2b2cc73aab5

          SHA256

          222abd1ab12a0e35502ddb96b0590b21082ca7c8f12c61c207b14b9ac8c806f5

          SHA512

          b4272c7bb9bff37de058477dfef354a04398f3f9094115967ecdc29fd63f9d98665eb6090b8e5310dc0990193c60d8dffd1dd6c8f0dd21d7c8bc9218c0e697c5