Analysis
-
max time kernel
150s -
max time network
102s -
platform
windows11-21h2_x64 -
resource
win11-20250502-en -
resource tags
arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system -
submitted
05/06/2025, 08:15
Static task
static1
Behavioral task
behavioral1
Sample
c3836316a31a4634f5c54d66fe14d38a8e0b533079ba19f0ff0ae9d5d1f26567.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral2
Sample
c3836316a31a4634f5c54d66fe14d38a8e0b533079ba19f0ff0ae9d5d1f26567.exe
Resource
win11-20250502-en
General
-
Target
c3836316a31a4634f5c54d66fe14d38a8e0b533079ba19f0ff0ae9d5d1f26567.exe
-
Size
24KB
-
MD5
cd3f0a72b25ff0c8433d823d6bb6bfa8
-
SHA1
692da6dfe5594c29394ef862b7a90c9db3a6c2a7
-
SHA256
c3836316a31a4634f5c54d66fe14d38a8e0b533079ba19f0ff0ae9d5d1f26567
-
SHA512
dfd9bbf1da81e3d7ef2f06915172ba869d7a9ffcd5a535ea7e8b5d7445a8d07ccff5a718adf9983a9a42570227dc4d7d4ac03484770f4086195a95b6d4d4ea08
-
SSDEEP
384:hAg+5OCZ4W6/KWLsqmFae+rOAqmFae+rOIW2JhuC2JhuOxAxovAJOSAJOR:uZ4FLz8ae+rOn8ae+rOoJhiJh3AJLAJs
Malware Config
Signatures
-
Cosmu family
-
Detects Cosmu payload 1 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/memory/2992-1219-0x0000000000400000-0x0000000000407000-memory.dmp family_cosmu -
Renames multiple (5360) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pl\System.Xaml.resources.dll.tmp c3836316a31a4634f5c54d66fe14d38a8e0b533079ba19f0ff0ae9d5d1f26567.exe File created C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-bridge-office.xrm-ms.tmp c3836316a31a4634f5c54d66fe14d38a8e0b533079ba19f0ff0ae9d5d1f26567.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-ppd.xrm-ms.tmp c3836316a31a4634f5c54d66fe14d38a8e0b533079ba19f0ff0ae9d5d1f26567.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui.tmp c3836316a31a4634f5c54d66fe14d38a8e0b533079ba19f0ff0ae9d5d1f26567.exe File created C:\Program Files\Google\Chrome\Application\133.0.6943.60\Locales\it.pak.tmp c3836316a31a4634f5c54d66fe14d38a8e0b533079ba19f0ff0ae9d5d1f26567.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Grace-ppd.xrm-ms.tmp c3836316a31a4634f5c54d66fe14d38a8e0b533079ba19f0ff0ae9d5d1f26567.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sk-sk.dll.tmp c3836316a31a4634f5c54d66fe14d38a8e0b533079ba19f0ff0ae9d5d1f26567.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hans\WindowsFormsIntegration.resources.dll.tmp c3836316a31a4634f5c54d66fe14d38a8e0b533079ba19f0ff0ae9d5d1f26567.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_CopyDrop32x32.gif.tmp c3836316a31a4634f5c54d66fe14d38a8e0b533079ba19f0ff0ae9d5d1f26567.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsar.xml.tmp c3836316a31a4634f5c54d66fe14d38a8e0b533079ba19f0ff0ae9d5d1f26567.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\dt_socket.dll.tmp c3836316a31a4634f5c54d66fe14d38a8e0b533079ba19f0ff0ae9d5d1f26567.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jaas_nt.dll.tmp c3836316a31a4634f5c54d66fe14d38a8e0b533079ba19f0ff0ae9d5d1f26567.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml.tmp c3836316a31a4634f5c54d66fe14d38a8e0b533079ba19f0ff0ae9d5d1f26567.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-ul-oob.xrm-ms.tmp c3836316a31a4634f5c54d66fe14d38a8e0b533079ba19f0ff0ae9d5d1f26567.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-ul-oob.xrm-ms.tmp c3836316a31a4634f5c54d66fe14d38a8e0b533079ba19f0ff0ae9d5d1f26567.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Grace-ppd.xrm-ms.tmp c3836316a31a4634f5c54d66fe14d38a8e0b533079ba19f0ff0ae9d5d1f26567.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.DocumentServices.dll.tmp c3836316a31a4634f5c54d66fe14d38a8e0b533079ba19f0ff0ae9d5d1f26567.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\WindowsBase.resources.dll.tmp c3836316a31a4634f5c54d66fe14d38a8e0b533079ba19f0ff0ae9d5d1f26567.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngcc.md.tmp c3836316a31a4634f5c54d66fe14d38a8e0b533079ba19f0ff0ae9d5d1f26567.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_Grace-ul-oob.xrm-ms.tmp c3836316a31a4634f5c54d66fe14d38a8e0b533079ba19f0ff0ae9d5d1f26567.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ul-oob.xrm-ms.tmp c3836316a31a4634f5c54d66fe14d38a8e0b533079ba19f0ff0ae9d5d1f26567.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnvpxy.dll.tmp c3836316a31a4634f5c54d66fe14d38a8e0b533079ba19f0ff0ae9d5d1f26567.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\PresentationCore.resources.dll.tmp c3836316a31a4634f5c54d66fe14d38a8e0b533079ba19f0ff0ae9d5d1f26567.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationClientSideProviders.resources.dll.tmp c3836316a31a4634f5c54d66fe14d38a8e0b533079ba19f0ff0ae9d5d1f26567.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-math-l1-1-0.dll.tmp c3836316a31a4634f5c54d66fe14d38a8e0b533079ba19f0ff0ae9d5d1f26567.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-ppd.xrm-ms.tmp c3836316a31a4634f5c54d66fe14d38a8e0b533079ba19f0ff0ae9d5d1f26567.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.DataStreamer.Excel.dll.tmp c3836316a31a4634f5c54d66fe14d38a8e0b533079ba19f0ff0ae9d5d1f26567.exe File created C:\Program Files\Microsoft Office\root\Office16\OFFSYMSL.TTF.tmp c3836316a31a4634f5c54d66fe14d38a8e0b533079ba19f0ff0ae9d5d1f26567.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\Office Word 2003 Look.dotx.tmp c3836316a31a4634f5c54d66fe14d38a8e0b533079ba19f0ff0ae9d5d1f26567.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\ANTQUAB.TTF.tmp c3836316a31a4634f5c54d66fe14d38a8e0b533079ba19f0ff0ae9d5d1f26567.exe File created C:\Program Files\7-Zip\Lang\sq.txt.tmp c3836316a31a4634f5c54d66fe14d38a8e0b533079ba19f0ff0ae9d5d1f26567.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.DiaSymReader.Native.amd64.dll.tmp c3836316a31a4634f5c54d66fe14d38a8e0b533079ba19f0ff0ae9d5d1f26567.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\PresentationUI.resources.dll.tmp c3836316a31a4634f5c54d66fe14d38a8e0b533079ba19f0ff0ae9d5d1f26567.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ko\UIAutomationClient.resources.dll.tmp c3836316a31a4634f5c54d66fe14d38a8e0b533079ba19f0ff0ae9d5d1f26567.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\ShapeCollector.exe.mui.tmp c3836316a31a4634f5c54d66fe14d38a8e0b533079ba19f0ff0ae9d5d1f26567.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp c3836316a31a4634f5c54d66fe14d38a8e0b533079ba19f0ff0ae9d5d1f26567.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-ppd.xrm-ms.tmp c3836316a31a4634f5c54d66fe14d38a8e0b533079ba19f0ff0ae9d5d1f26567.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-pl.xrm-ms.tmp c3836316a31a4634f5c54d66fe14d38a8e0b533079ba19f0ff0ae9d5d1f26567.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer.dll.tmp c3836316a31a4634f5c54d66fe14d38a8e0b533079ba19f0ff0ae9d5d1f26567.exe File created C:\Program Files\Common Files\microsoft shared\ink\ca-ES\tipresx.dll.mui.tmp c3836316a31a4634f5c54d66fe14d38a8e0b533079ba19f0ff0ae9d5d1f26567.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\mscordbi.dll.tmp c3836316a31a4634f5c54d66fe14d38a8e0b533079ba19f0ff0ae9d5d1f26567.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE.tmp c3836316a31a4634f5c54d66fe14d38a8e0b533079ba19f0ff0ae9d5d1f26567.exe File created C:\Program Files\Common Files\microsoft shared\ink\bg-BG\tipresx.dll.mui.tmp c3836316a31a4634f5c54d66fe14d38a8e0b533079ba19f0ff0ae9d5d1f26567.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-localization-l1-2-0.dll.tmp c3836316a31a4634f5c54d66fe14d38a8e0b533079ba19f0ff0ae9d5d1f26567.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\Microsoft.VisualBasic.Forms.resources.dll.tmp c3836316a31a4634f5c54d66fe14d38a8e0b533079ba19f0ff0ae9d5d1f26567.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription4-ul-oob.xrm-ms.tmp c3836316a31a4634f5c54d66fe14d38a8e0b533079ba19f0ff0ae9d5d1f26567.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_KMS_Client-ppd.xrm-ms.tmp c3836316a31a4634f5c54d66fe14d38a8e0b533079ba19f0ff0ae9d5d1f26567.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\MSO20SKYPEWIN32.DLL.tmp c3836316a31a4634f5c54d66fe14d38a8e0b533079ba19f0ff0ae9d5d1f26567.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\rtscom.dll.mui.tmp c3836316a31a4634f5c54d66fe14d38a8e0b533079ba19f0ff0ae9d5d1f26567.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\PresentationCore.resources.dll.tmp c3836316a31a4634f5c54d66fe14d38a8e0b533079ba19f0ff0ae9d5d1f26567.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssv.dll.tmp c3836316a31a4634f5c54d66fe14d38a8e0b533079ba19f0ff0ae9d5d1f26567.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-pl.xrm-ms.tmp c3836316a31a4634f5c54d66fe14d38a8e0b533079ba19f0ff0ae9d5d1f26567.exe File created C:\Program Files\Microsoft Office\root\Office16\AUDIOSEARCHSAPIFE.DLL.tmp c3836316a31a4634f5c54d66fe14d38a8e0b533079ba19f0ff0ae9d5d1f26567.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\AUTHOR.XSL.tmp c3836316a31a4634f5c54d66fe14d38a8e0b533079ba19f0ff0ae9d5d1f26567.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-80.png.tmp c3836316a31a4634f5c54d66fe14d38a8e0b533079ba19f0ff0ae9d5d1f26567.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml.tmp c3836316a31a4634f5c54d66fe14d38a8e0b533079ba19f0ff0ae9d5d1f26567.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\PresentationCore.resources.dll.tmp c3836316a31a4634f5c54d66fe14d38a8e0b533079ba19f0ff0ae9d5d1f26567.exe File created C:\Program Files\Google\Chrome\Application\133.0.6943.60\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig.tmp c3836316a31a4634f5c54d66fe14d38a8e0b533079ba19f0ff0ae9d5d1f26567.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp c3836316a31a4634f5c54d66fe14d38a8e0b533079ba19f0ff0ae9d5d1f26567.exe File created C:\Program Files\Microsoft Office\root\Office16\TecProxy.dll.tmp c3836316a31a4634f5c54d66fe14d38a8e0b533079ba19f0ff0ae9d5d1f26567.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\ReachFramework.resources.dll.tmp c3836316a31a4634f5c54d66fe14d38a8e0b533079ba19f0ff0ae9d5d1f26567.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\System.Windows.Forms.Design.resources.dll.tmp c3836316a31a4634f5c54d66fe14d38a8e0b533079ba19f0ff0ae9d5d1f26567.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.officemuiset.msi.16.en-us.xml.tmp c3836316a31a4634f5c54d66fe14d38a8e0b533079ba19f0ff0ae9d5d1f26567.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-ppd.xrm-ms.tmp c3836316a31a4634f5c54d66fe14d38a8e0b533079ba19f0ff0ae9d5d1f26567.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c3836316a31a4634f5c54d66fe14d38a8e0b533079ba19f0ff0ae9d5d1f26567.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c3836316a31a4634f5c54d66fe14d38a8e0b533079ba19f0ff0ae9d5d1f26567.exe"C:\Users\Admin\AppData\Local\Temp\c3836316a31a4634f5c54d66fe14d38a8e0b533079ba19f0ff0ae9d5d1f26567.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2992
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD5bc59df5742c57d9911cb0e33c090f02f
SHA124cacc0b2dac4d1bf3de504e4f13e38eb91b9e30
SHA25681a14cbffb905eb5781f81d0482971c43f3e89f9f55e267ec3e63b05ff01fa72
SHA51227d545fad97dee151fa58694cd3c36bf17c7639aae0a1ac9e4ea56d5f884cb666b5b128d69104b5c0bbeb1a23dcaab983d8acb4080fa4bb7eddca1a549d59384
-
Filesize
105KB
MD56b31ea2cf7250c4d43497a88bc5c61bf
SHA1f262d989dee2ec9f7056b47307408c4c08914a26
SHA256a31f1920805be6622c937bc30076917589c875c6b9002256ed674d39d8288297
SHA5120bf81ea5caaa705df4704be3b343cb457edbb2303af08995c18944e1fa9c0b089b90dc55e5bc38d4a5f1ebc676e4585d52857b15cd249bb1fd640e7ba8b9850b