Analysis

  • max time kernel
    150s
  • max time network
    134s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250502-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/06/2025, 08:15

General

  • Target

    c284bfd70aad3207fc289531fb05cda5d8154d3624718b7db91fac6569a60132.exe

  • Size

    85KB

  • MD5

    93b4f040d2459e0e9f51758492921bc8

  • SHA1

    b845596bc215479dc8e9abb08b02800a1242bd16

  • SHA256

    c284bfd70aad3207fc289531fb05cda5d8154d3624718b7db91fac6569a60132

  • SHA512

    6c25264ea60156a0988f266ae1762cc2be884355cbe8aad4f439a34824103bc4f40730a9fb7443b7173f90610417f3700bccd550654fd7b2352ede178d167238

  • SSDEEP

    1536:s7ZppApdII1grC35rtLgnTVoAUZY/ECGn6cmi8eEXcBxOBxP:spWpT9InTVsZYFG6cZxnOnP

Malware Config

Signatures

  • Cosmu

    Cosmu is a Windows worm written in C++.

  • Cosmu family
  • Detects Cosmu payload 2 IoCs

    Cosmu is a worm written in C++.

  • Renames multiple (5105) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\c284bfd70aad3207fc289531fb05cda5d8154d3624718b7db91fac6569a60132.exe
    "C:\Users\Admin\AppData\Local\Temp\c284bfd70aad3207fc289531fb05cda5d8154d3624718b7db91fac6569a60132.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:3632

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\$Recycle.Bin\S-1-5-21-3342576763-1998465526-3870295501-1000\desktop.ini.tmp

          Filesize

          85KB

          MD5

          cf173ad08921514581161aa1f4a80066

          SHA1

          1da90abb340a6221e95bc341bbf48993b0eccfbf

          SHA256

          79559197d7fb8459ab5ce16c2b4434f50bd97c93466a7c93407b03375d3d6cbb

          SHA512

          13f4a92a8701a5893a2d13cfd10af95dbd5758d78e691845e700a2ec84f06f2ddba090bc54983c5ed297474c6b5029c4c9eece7dcc9a65728c044679fa795449

        • C:\fa79de221d524b769d0447\2010_x64.log.html.tmp

          Filesize

          170KB

          MD5

          edc42ae95460840fa4f3f0c674f17641

          SHA1

          ca2ca9e08491bf54100bacf43221fd89d5be7e75

          SHA256

          9ba785fddbc4feb4d8fb40acc257016d7c8219c20b1a0fa7dc0440878e6f7c0c

          SHA512

          05c2f094fe9f22d4a4b7b8dc37281b3e09198258a18fede49d0542059a8d9a71ade559413d58fdfed6f56dbec5eadb952d4a893d012be3f0d0867910dc93ba57