Analysis

  • max time kernel
    150s
  • max time network
    136s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250502-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/06/2025, 08:18

General

  • Target

    6d603198b881a83e2d4908e309a2d6f2f5709aaa760766f221f9474c01367b02.exe

  • Size

    281KB

  • MD5

    3a85e8a4af518aa58cc7891ee95db231

  • SHA1

    df0bae9ae511225ec962aeca1fcf0b3748b37f00

  • SHA256

    6d603198b881a83e2d4908e309a2d6f2f5709aaa760766f221f9474c01367b02

  • SHA512

    3f825f1033b50d7837ac374280dc6e6e427afe0edf36ad684ac75a8828356e20d41bf48b0483c2e3fd3028d77df3f6996e2c158c41d90b96d4338b2ae4831b80

  • SSDEEP

    768:s7BlpppARFbhdLz8ae+rOn8ae+rOb83osGOUiuJtfosGOUiuJt5:s7ZppApdIIC0E

Malware Config

Signatures

  • Cosmu

    Cosmu is a Windows worm written in C++.

  • Cosmu family
  • Detects Cosmu payload 2 IoCs

    Cosmu is a worm written in C++.

  • Renames multiple (4508) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\6d603198b881a83e2d4908e309a2d6f2f5709aaa760766f221f9474c01367b02.exe
    "C:\Users\Admin\AppData\Local\Temp\6d603198b881a83e2d4908e309a2d6f2f5709aaa760766f221f9474c01367b02.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:4792

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\$Recycle.Bin\S-1-5-21-3623617754-4043701611-775564599-1000\desktop.ini.tmp

          Filesize

          282KB

          MD5

          035edab9eab580be21a60234595f43f3

          SHA1

          c672e55afc4ee66f9e9e5815fede65a6049d39e4

          SHA256

          1b022d566c0b9cdbe0ea801c74637a11ab4f129c1bed7072682951afbadc3e77

          SHA512

          c002de3de6e6ee0c1b58113d8d963c1a912f2830a2c25bee62fd4c637cc6e388fa3a0707f4b3f808bcc577f5b519d9be9a915b9a6ce8ea2cf7a4af73a2d17e16

        • C:\b96a7bef2438b67e1aee\2010_x86.log.html.tmp

          Filesize

          362KB

          MD5

          7bc04790a3a793eaf560bf05ad4cd326

          SHA1

          0df16b525673032a1be9bd370b39ac4011f90af6

          SHA256

          81acd69d97c40afd36903b361585f83c3c97442f9bb2546133f2357db5f88b12

          SHA512

          9b908917cb86ead9a1796be94bed6f16146ed5a5f2ce21141a0866885f7632e129aff9da1143b42a31b08556085a5015390651d9f965328ba4006ac1f89b232b