Analysis

  • max time kernel
    150s
  • max time network
    109s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250502-en
  • resource tags

    arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    05/06/2025, 08:15

General

  • Target

    c284bfd70aad3207fc289531fb05cda5d8154d3624718b7db91fac6569a60132.exe

  • Size

    85KB

  • MD5

    93b4f040d2459e0e9f51758492921bc8

  • SHA1

    b845596bc215479dc8e9abb08b02800a1242bd16

  • SHA256

    c284bfd70aad3207fc289531fb05cda5d8154d3624718b7db91fac6569a60132

  • SHA512

    6c25264ea60156a0988f266ae1762cc2be884355cbe8aad4f439a34824103bc4f40730a9fb7443b7173f90610417f3700bccd550654fd7b2352ede178d167238

  • SSDEEP

    1536:s7ZppApdII1grC35rtLgnTVoAUZY/ECGn6cmi8eEXcBxOBxP:spWpT9InTVsZYFG6cZxnOnP

Malware Config

Signatures

  • Cosmu

    Cosmu is a Windows worm written in C++.

  • Cosmu family
  • Detects Cosmu payload 2 IoCs

    Cosmu is a worm written in C++.

  • Renames multiple (5188) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\c284bfd70aad3207fc289531fb05cda5d8154d3624718b7db91fac6569a60132.exe
    "C:\Users\Admin\AppData\Local\Temp\c284bfd70aad3207fc289531fb05cda5d8154d3624718b7db91fac6569a60132.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:4968

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\$Recycle.Bin\S-1-5-21-3518521428-3897247806-4080064211-1000\desktop.ini.tmp

          Filesize

          85KB

          MD5

          b79608a79f837f0e2c33664dac26e9d1

          SHA1

          6e970be973742adbc0bb7854d973c34976eff9b0

          SHA256

          86745d8603850d6fff887ff755a9546e8ef2f944b582b3f7178f461ce8716ad5

          SHA512

          d8c93cf3dc2c408c7d32733fe63060ed67b230fa947dcad27f662a66e80ecc8477b0db5cf2abdf213f7d0dcce9bda59f5d474f83f5562c4794603db71392b6a3

        • C:\ef24ccacc0fb7a1128713900cef14716\2010_x64.log.html.tmp

          Filesize

          171KB

          MD5

          2cdb0545abb1518fcd39ad32933fc790

          SHA1

          5f7c792a29297c756469d5c2790edfa9344a4caf

          SHA256

          284f0aa604f724e68c3c7029680884856f5078828971bf2998e582766ea0cadb

          SHA512

          cfad57ce1c4861418a5cb76b99ef9c3493e71eb8eeaf5100b149473394edd118a2536e7ecec14e3b3c6f34cdea184f6c7423f41857d501e172239ed1e486ba2a