Analysis

  • max time kernel
    149s
  • max time network
    138s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250502-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/06/2025, 08:17

General

  • Target

    aa672896703c6c2e8a3dceb6a2c43b0c62e5ea83c369824e45c927c658b4c343.exe

  • Size

    27KB

  • MD5

    4a79767c29563c4595e4fd9bc2205446

  • SHA1

    e615101dcfa8ed975b56c53481dda9b51bc9b957

  • SHA256

    aa672896703c6c2e8a3dceb6a2c43b0c62e5ea83c369824e45c927c658b4c343

  • SHA512

    4358b90a6960956625764d4fe9c841274b39f3e88321adf9e24bc40eca3e9be5baea6246fceaad3a41861fc5ba36a2c73d931eadc2d6f577bdc58ed39d255c73

  • SSDEEP

    768:uZ4FLz8ae+rOn8ae+rO44Ph4PmbX8xsni1xDbX8xsni1xQ:uGII4ehem7AP7A0

Malware Config

Signatures

  • Cosmu

    Cosmu is a Windows worm written in C++.

  • Cosmu family
  • Detects Cosmu payload 1 IoCs

    Cosmu is a worm written in C++.

  • Renames multiple (5205) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\aa672896703c6c2e8a3dceb6a2c43b0c62e5ea83c369824e45c927c658b4c343.exe
    "C:\Users\Admin\AppData\Local\Temp\aa672896703c6c2e8a3dceb6a2c43b0c62e5ea83c369824e45c927c658b4c343.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:3132

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\$Recycle.Bin\S-1-5-21-3920234085-916416549-2700794571-1000\desktop.ini.tmp

          Filesize

          27KB

          MD5

          245a538b9257120d852dc27a6bf99b8e

          SHA1

          9e0e7eb85abdfeeb2da3a838402ed4d1969076cf

          SHA256

          b52f78180050e32faf8c112780ebdec28a604753a840f361df4425f7921a9a52

          SHA512

          96b6c2c7ac632b24ffc59314920c28de09fbfb9de510be155cb37a99abe1734b01526fa9d6fea18802c3978c3caecae3cb69fc091439cd480d9a19ec538975bc

        • C:\6eaadd5e1536cd09900c16de307910\2010_x86.log.html.tmp

          Filesize

          108KB

          MD5

          b29feb609272401dafd21421b33bce38

          SHA1

          e2fdf3b09b799258f54e3c3373ca938343757cc6

          SHA256

          a306c3bcd9e89c2f4e7464dfe456fc8270d3c713d3a6564c3471f3e91ad8adfe

          SHA512

          b5caaea04f0bde1e8d95e04de68191b361cc74ebe10d83a4063e558c0843f171306dac1924c2002c339856b380c7e4cf9f13b32988918b2e09d276a3c51b5dd3

        • memory/3132-797-0x0000000000400000-0x0000000000407000-memory.dmp

          Filesize

          28KB