Analysis
-
max time kernel
150s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20250610-en -
resource tags
arch:x64arch:x86image:win10v2004-20250610-enlocale:en-usos:windows10-2004-x64system -
submitted
03/07/2025, 05:27
Static task
static1
Behavioral task
behavioral1
Sample
e7d974fb9c76f1a4afdb7c266f27b9227aeaba8809932f833a47f1f2b6fc5361.exe
Resource
win10v2004-20250610-en
General
-
Target
e7d974fb9c76f1a4afdb7c266f27b9227aeaba8809932f833a47f1f2b6fc5361.exe
-
Size
77KB
-
MD5
028f0b28c785e5ee6d7ecaa15e157e8e
-
SHA1
bafea4ff563277e94c5eb292706c4e2a31227cad
-
SHA256
e7d974fb9c76f1a4afdb7c266f27b9227aeaba8809932f833a47f1f2b6fc5361
-
SHA512
9bef42b88697b27e110a119a57c8a05c3ea574e70b18fed20d3013d3a9c7c98c0a513a1e93561fe82ec8e567ac75f74a36a17322b2e78bb5d1e148d75f73990b
-
SSDEEP
768:uZ4FLm8Q8Boxn6oxSoxn6ox1YFlLYFlkE2lGZD4TzvPYNWw1Asvvzzv6t0+3eQKK:uGsx1xtx1xWg/+I8K/XCKCGSqzVw
Malware Config
Signatures
-
Cosmu family
-
Detects Cosmu payload 1 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral1/memory/3352-23-0x0000000000400000-0x0000000000407000-memory.dmp family_cosmu -
Renames multiple (5220) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE 2 IoCs
pid Process 4060 _createdump.exe 4444 Zombie.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Zombie.exe e7d974fb9c76f1a4afdb7c266f27b9227aeaba8809932f833a47f1f2b6fc5361.exe File opened for modification C:\Windows\SysWOW64\Zombie.exe e7d974fb9c76f1a4afdb7c266f27b9227aeaba8809932f833a47f1f2b6fc5361.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\jre\bin\jpeg.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\ecc.md.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-100.png.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\rsod\dcfmui.msi.16.en-us.boot.tree.dat.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml.tmp Zombie.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msaddsr.dll.mui.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\glib-lite.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Violet.xml.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Grace-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHSRN.DAT.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-synch-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.WindowsDesktop.App.deps.json.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Grace-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_f3\FA000000003.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\ONBttnOL.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\include\jni.h.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\Resources.pri.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Xml.XmlSerializer.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Common Files\System\ado\msador15.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Transactions.Local.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hant\System.Windows.Forms.Design.resources.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\offsyml.ttf.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll.tmp Zombie.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msadcor.dll.mui.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationClient.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Input.Manipulations.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\cs\PresentationCore.resources.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\BOMB.WAV.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\cs\msipc.dll.mui.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationTypes.resources.dll.tmp Zombie.exe File created C:\Program Files\Google\Chrome\Application\133.0.6943.60\Locales\zh-TW.pak.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-synch-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.dll.config.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN097.XML.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\MSGR8EN.LEX.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\bin\plugin2\msvcp140.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\MSO.FRAMEPROTOCOLWIN32.DLL.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] Zombie.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\PresentationUI.resources.dll.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Grace-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\pt-BR\tipresx.dll.mui.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Forms.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationClientSideProviders.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Security.Cryptography.Xml.dll.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-memory-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\bin\vcruntime140_1.dll.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\lib\psfontj2d.properties.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClientIsv.man.tmp Zombie.exe File created C:\Program Files\Common Files\System\Ole DB\sqlxmlx.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Debug.dll.tmp Zombie.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e7d974fb9c76f1a4afdb7c266f27b9227aeaba8809932f833a47f1f2b6fc5361.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Zombie.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 3352 wrote to memory of 4060 3352 e7d974fb9c76f1a4afdb7c266f27b9227aeaba8809932f833a47f1f2b6fc5361.exe 87 PID 3352 wrote to memory of 4060 3352 e7d974fb9c76f1a4afdb7c266f27b9227aeaba8809932f833a47f1f2b6fc5361.exe 87 PID 3352 wrote to memory of 4444 3352 e7d974fb9c76f1a4afdb7c266f27b9227aeaba8809932f833a47f1f2b6fc5361.exe 88 PID 3352 wrote to memory of 4444 3352 e7d974fb9c76f1a4afdb7c266f27b9227aeaba8809932f833a47f1f2b6fc5361.exe 88 PID 3352 wrote to memory of 4444 3352 e7d974fb9c76f1a4afdb7c266f27b9227aeaba8809932f833a47f1f2b6fc5361.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\e7d974fb9c76f1a4afdb7c266f27b9227aeaba8809932f833a47f1f2b6fc5361.exe"C:\Users\Admin\AppData\Local\Temp\e7d974fb9c76f1a4afdb7c266f27b9227aeaba8809932f833a47f1f2b6fc5361.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\_createdump.exe"_createdump.exe"2⤵
- Executes dropped EXE
PID:4060
-
-
C:\Windows\SysWOW64\Zombie.exe"C:\Windows\system32\Zombie.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4444
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
21KB
MD56cf8daa1802afe093cfe70c1488ff7ca
SHA13ac3a814fc3a32282666c921f3e0202cfa19939b
SHA25615bc67893d18046731d4377d8b6f4d7cea86f5e1d88137526d2d915f94f04ec4
SHA5121b66f27fdc053cf1c8f2d574bdb3c576c4664a157419810f786a4a6a01c165f3e745492c7f8646d8a84c8a47bf3a17e1fddaa79096165558687a2e876899c382
-
Filesize
56KB
MD5a05b36f6129223951282f9df776761b1
SHA1ec87fa41a670cffa5d77f64366fe109278661f2c
SHA2565113e7ae92f3a7aebc7f8e363209866d4d743b06a26c67e0886979a56fd3a10d
SHA51238b588b28057994305a3abc37d98770ab7ff905cba6da35e91b2936b99823955fc91b90a23174d53337dd62e320b9bac066b76734bf657de9fad6d37071c70da
-
Filesize
20KB
MD50b56482e76bc589939b1556b4b3cd020
SHA1aeda9a8d275a57cc74ada41988ae1b12400a4205
SHA256433ba76b16991acad4c04c4b90b84660454cbd26892de5fc93fa9c379c2559c7
SHA5122321d5960b8c7cbf94a2c6eee44fab50cd582030b337aa1528f11444237e9680228c62a64e7237551323e046f21df460f86ae86da82ff54ad8fe93469eccafd9