Analysis

  • max time kernel
    149s
  • max time network
    102s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250502-en
  • resource tags

    arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    05/06/2025, 08:18

General

  • Target

    6d603198b881a83e2d4908e309a2d6f2f5709aaa760766f221f9474c01367b02.exe

  • Size

    281KB

  • MD5

    3a85e8a4af518aa58cc7891ee95db231

  • SHA1

    df0bae9ae511225ec962aeca1fcf0b3748b37f00

  • SHA256

    6d603198b881a83e2d4908e309a2d6f2f5709aaa760766f221f9474c01367b02

  • SHA512

    3f825f1033b50d7837ac374280dc6e6e427afe0edf36ad684ac75a8828356e20d41bf48b0483c2e3fd3028d77df3f6996e2c158c41d90b96d4338b2ae4831b80

  • SSDEEP

    768:s7BlpppARFbhdLz8ae+rOn8ae+rOb83osGOUiuJtfosGOUiuJt5:s7ZppApdIIC0E

Malware Config

Signatures

  • Cosmu

    Cosmu is a Windows worm written in C++.

  • Cosmu family
  • Detects Cosmu payload 2 IoCs

    Cosmu is a worm written in C++.

  • Renames multiple (4653) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\6d603198b881a83e2d4908e309a2d6f2f5709aaa760766f221f9474c01367b02.exe
    "C:\Users\Admin\AppData\Local\Temp\6d603198b881a83e2d4908e309a2d6f2f5709aaa760766f221f9474c01367b02.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2532

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\$Recycle.Bin\S-1-5-21-2329104403-2882594830-3136665766-1000\desktop.ini.tmp

          Filesize

          282KB

          MD5

          cf2813dff340fc4a69d194e84bb5282e

          SHA1

          1f8a8d7ebe5f3cd93de67872cec0f8aa3e6b0251

          SHA256

          c1a62961a6fb35184929cca0f23c81323318e6607c25b4ddeca31ad05cb89ae1

          SHA512

          485a4d141cb1e758efbb13e25fdf75b30c7fa76db7febfe1983a3f5b89c573365647fffebbb186663e1f9a3da95deea7ea8f3d8d1eb518eba25f03bd2cef8b84

        • C:\bf6fffe43a1488106117f05273896fef\2010_x86.log.html.tmp

          Filesize

          363KB

          MD5

          9762f1353e83a5cdc9509d859f41b5bb

          SHA1

          12da51647bbc455e64125d9e5881edefba4f44dc

          SHA256

          083af4dc06c9ffc1748568cb1959a44076cab434b5947cbc7160444dea5b45c9

          SHA512

          670625877b6e305ce7f73810e78a10664d1090cef554f0c71ab8f5ca2d55a03ae6675eae1d7a2f50f8832274f0e8b92299d76912b26209ae5d39d32c0edb7553