Analysis

  • max time kernel
    150s
  • max time network
    103s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250619-en
  • resource tags

    arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    03/07/2025, 05:26

General

  • Target

    05883a6b3b770d06f9bfbac1145cfe5107ce748842dbf15660e56c6b5ab88983.exe

  • Size

    276KB

  • MD5

    82393db8e99c15a391c5be37af988267

  • SHA1

    2105ab908b23e88901e56ffaef98ec75716b3e5e

  • SHA256

    05883a6b3b770d06f9bfbac1145cfe5107ce748842dbf15660e56c6b5ab88983

  • SHA512

    5afecc4357747729ae39cfb180f6c84cf06b04cc4af7c5378cc6902f1ce7496bb804b232222854cec65c923b629f8d62dae3a2da4fab6046b600a01de6b3b563

  • SSDEEP

    6144:g3P3Wg9pU+xWkDr468eIDFx1xJsktJ/PHqC:t+//eeyx1

Malware Config

Signatures

  • Cosmu

    Cosmu is a Windows worm written in C++.

  • Cosmu family
  • Detects Cosmu payload 1 IoCs

    Cosmu is a worm written in C++.

  • Renames multiple (4696) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\05883a6b3b770d06f9bfbac1145cfe5107ce748842dbf15660e56c6b5ab88983.exe
    "C:\Users\Admin\AppData\Local\Temp\05883a6b3b770d06f9bfbac1145cfe5107ce748842dbf15660e56c6b5ab88983.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:5560

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\$Recycle.Bin\S-1-5-21-3972667009-3658015838-2693993929-1000\desktop.ini.tmp

          Filesize

          276KB

          MD5

          0032d6ea790e94c29708e2c5a77cf6b8

          SHA1

          3652f485080ddab4e4248437f1c2b316a269d155

          SHA256

          eaf80a182872b5bfdadabd777ff8d070b41a895f7f3277692dc225daf19d2500

          SHA512

          189d62e37b20ff3393ad6c06d5049d4a59c37b1c28d070f7a6cca96fe6a018977c81cde9b385fa3dfbafefb741be32620c15720085e3540a222c2a276a410890

        • C:\e526fccd55275c7cc1d508f478cd\2010_x64.log.html.tmp

          Filesize

          362KB

          MD5

          d8eaf551148a3d05680a0fbeb0997e2c

          SHA1

          86699be4331c4bf5ef6a6690ea556aaba1fdab8c

          SHA256

          c6f4fc7f1184c8d9f88d80f615d25eed5bdbaadaea3a3801e8c729b2cf08d9b7

          SHA512

          ace500063b2a949f3d6a84aab48fcf0f10956b880aaeec299edf9794cc841711985538205836e5e3fd135ca2d9630a3c497bda712095c4b5ce441dede41e2bd1

        • memory/5560-825-0x0000000000400000-0x0000000000407000-memory.dmp

          Filesize

          28KB