27489b34f210fdd18c985f53bbe9b6fea99202af0798eb656239b169d935cb83

Sharing

Copy URL Twitter E-mail

General

Target
Cogmind.7z
Size 59.2MB
Sample260627-e7rm2sht9p
SHA256 27489b34f210fdd18c985f53bbe9b6fea99202af0798eb656239b169d935cb83
MD5 aef0e79ebbbcf1bf72d7f7a8ebf1017d
SHA1 b6f9da58a38ee17f8ce3ee94fdb23f7426c95128
SHA512 c3f949786c6dac67f2bba5d4ff9170ca023db64d1d6350a5b269e11890e3672468e56d19bb936d47e60d5a09be6f485a10f6fd1a7ca17577e2cae62cc6cec5d7
SSDEEP 1572864:muSEG8zFHigePSATza9kiLOTnfQmtdLB3ToVYqxj4YFr2pCPh9q6:muSoF3Wza9kzQmPozxj9FSpCrX
TLSH
T145D733821D31FD9156780905A63BE061BFCE79EE4C9225B42AC378C571A1ECB6FCF261
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Cogmind/data/dialogue4.bin
- Size 11KB
- SHA256 ecccb2eaaeb53c39d429edef3e399fcba5d94ee535da2fb66a8811ae4590f426
- MD5 e5b8ef2ea0f896800d9b65a8ae582c69
- SHA1 64b6c24b9db816e7ea49c8e8b3911d6495f9fdec
- SHA512 28f6ba353577a79ab88226b6358c264f69dc6740b3d543106b9f2ecbef5bb5c7c1ef394f7863e4112e015992bf37a62a08914a98a88bb3c22d1a55d07bd4319e
- SSDEEP 192:xEAu3KJPAcF3Raf/Y2ak1Z5NCcK/56ok2dus27QnURi3pWNhVbXEOhk3e:xEaXIf/uyVCH56okHszn2Vbr
- TLSH
  T13032C0785302CCC2FE8320B118BDC526C5D825B8C9EAC62F6F85E027566E951DE7B38C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Cogmind/data/dialogue5.bin
- Size 16KB
- SHA256 8733aae31c2aff2ca008c0edbbbafcbe55f2c5e824ff8c6504486dabdb4a9527
- MD5 45ce3fbefbbaa33b0fce0bc9a1458868
- SHA1 c7eb6708a2d61b5f1a9e47fa7b56858650edd367
- SHA512 f1b08784ec6e5bef33793e704c249fc63ac1225fd76ca45af63c71762cea063a578ab045dc3b72655a992295332fa7fa4f5d62532f0fedc2c0cd8349eeb77145
- SSDEEP 384:29VdMgSYmvAhN6ayF7mX7r/PXvTNOZMFZG3KTExJ99:29Vq2NDyFurPXhOZu3Qxd
- TLSH
  T1B872D057CCC38DA4A38D445D8366F16AAF14F1598421BA0646E78CE1EF8CC23FDA2D62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  Cogmind/data/dialogue6.bin
- Size 8KB
- SHA256 fa2c9b325be1d5da798eb0bbe6596019858904368d2acf275acb4d923bc38fc7
- MD5 e947dc9f910c8da301e707e304ba0d42
- SHA1 f8e17d8a90db5db386c3c6611ff31f11041217b5
- SHA512 85228b22cca95865d7bae8acccbc6606d92a5a52142d40383423e0eb38a467ba8f77943fb7d636063655e4b94bfa6ee572bf7e4ebaac28d1c539cfe438176471
- SSDEEP 192:6PrULmag8PUz9aW+JMOnbnl/AG9ycC+PPCXwTrn2krr4kXuKrqn:6jUy+NLhAG9U+Wob1rzZY
- TLSH
  T15212AF02DA13915C437EB7E5A10AFE3734817B5FE522521B236972CD294AE0D142EF4A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Cogmind/data/entity.bin
- Size 20KB
- SHA256 d4fc3fa6cfe98cbd775db61076ad4a702b295f6369cf416162cd4e39258c0427
- MD5 ab1be3d2da1780bdd7628ad72f8330dd
- SHA1 47e3936cc2ecbdeccbc87cd1a9a6eac4e414e3f6
- SHA512 90f6be689005a932d46a1d9aebe9346a25248f8fcef4fff869895ad0d419e3adcb70c9a1f8a789d7bc7c1d1e0357aa8be5f37c5866bdd7b91ff0cddd0e0392ce
- SSDEEP 384:TeoOXzY2UeYQ5iJeGeTSyQ3Nip19v7uiWe6sI5gVe1yuj2M7qOUC2JY04BMyJygL:TefBUo5ijeZQ38t4sUgQ1yu32+yY0sVB
- TLSH
  T11592D1AD7B78158EF33A0C98BBC0134C4524EAD39F765969600649AA37E32E73C4CC66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Cogmind/data/fonts/_config.xt
- Size 22KB
- SHA256 c70a3fad7e562eadb2de3197bb4f67358e4a6f9d18811f93cfa23c1d2c223420
- MD5 1471566b55078350ffe63d4e4a58d0fc
- SHA1 f93839f448f386378dad2562437f566339ae3cc8
- SHA512 db501c59b8953d3858486ef3e48e71f26bd71cf2648a79143e568ed2cd2ced28dff46cda8d6c164e9cd04d4962956c65b5d77ffbf639fe950380cb024a1e6fab
- SSDEEP 96:rFi0QEef5w/e5yRCro1B8kUo2BInwMVvjA8q+XNJkJzhduPTtbs6q+8amA98Maow:RA3ACe8kwMl7oJN0P3YKcjAK
- TLSH
  T1FEB26E15F60F7ABDFF0BC2160115A199A185A3B5C1311E443B5BEA6C132D61F42FBF8A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  Cogmind/data/item.bin
- Size 18KB
- SHA256 6b846d659429710ec9ee63e2108e299b03ed96abf9cb2ec24d2dd88a10b061b8
- MD5 75977f2e90d343677a9341ea4e017f32
- SHA1 d415c79f631f36ecac3684b315e12925b8d8d955
- SHA512 3603d7a636621f1ae7606a6cc11c657861f85672b6b6bebd307681155d0c2cb0c5885cb53e06e9e8266ea78ada1d07e2316422da6dc7fbbb69a4d625970b4e41
- SSDEEP 384:W9kqqGMZ/KM+pyp/9LklBm86kpWsOYxu7vvIZk5q9TcQ44Y:Zqqmn8Lkl7QsOUuEtp/5Y
- TLSH
  T1AF82E087C89E3430882DC0B51021D1F2DFE7545EF570F9396E928688E38095BE2E1EE6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Cogmind/data/maps.bin
- Size 171KB
- SHA256 a5f7a588b6565178e5f62c724e8b6c1727f0ead4d14fe77dab91b4f89ea63f84
- MD5 48e2242ea719e6a1b6ab8863a73c792d
- SHA1 8af63bc3e6b70d2924cfa7166564f7855b7d0658
- SHA512 686ba167b1ed429d13fc8d2ef03d7ab4f7a44eb5f57579f02526b3af16c846436dfc9233401581c1a9dfaaeaa74b8d3ae2f367323f09280c990a1c0d455ca5ba
- SSDEEP 3072:pEf8rKWQkpEYWvJiVR0oqiq3Ax2Lay1wFLQdAFPulx9nE1VDmdPokzAVBD:a0rKIpYvJiViihoehcmFOPE1wokzAX
- TLSH
  T1A90412417E679254030573A55F2866FC70F6A8195E2A3C1A37FCF0E2806B3FF119667A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Cogmind/data/messages.bin
- Size 561KB
- SHA256 95d7c048755937df969a532bf3c588e84c0a6cd1a62d5395ed9536a04048af30
- MD5 17a7285fe81559a7ac46e138b90352be
- SHA1 9902101e8b8243483be3391a44729c53fe0f8a87
- SHA512 becb06e9e576258828817d0c4e917c211aa182e8c9948d7f9cb6463bf7ad17c6b72e2c1d1191ae7ad80d047037c7564b01d662dd44c799fac1ede99222491b51
- SSDEEP 12288:YpIKtB+v7WAs15rDz+9XXFmcquoxD7Pr0DNvSf:6IKzg7bsj4DquUPgDN6f
- TLSH
  T157C41263270D8E64C67E8460D4F256572525CEB337CF34F3A6403EE4EE89A1B1A6364E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Cogmind/data/particles.bin
- Size 1.5MB
- SHA256 a2093d6262cd2d20b9c814d8352f586cd4242711da926fe38290ca62321fcfc9
- MD5 c4819a7ed51949f8ef3a9685bf2bcb10
- SHA1 706ba62a41dcbdb4e153b5f2aa1bc9fb0c723161
- SHA512 b3508e669291d911d7bc35d311807b0b29a225ac968ed4d2b9bf7b154536f27dca18ecf4218bf08cc21610da341e9807085148e68735036f66d1d4193b72cc70
- SSDEEP 24576:czc8Em+i9ND0EE6+N2IEbmMulwDlo2Pg4tJJK7SAwcKMHAlSqWN3wLtviC:HcNQ6+kIEbPt+R4tHK7SEKMHWStNQtD
- TLSH
  T12C7533E874338A14634495FFFFE14D991A4C93EAE2AA0D270D989CF07A40165C3B5FE6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  Cogmind/libogg-0.dll
- Size 16KB
- SHA256 1e1db70f995287757b541ec1a5ac34948f735bcac7c43689cd11f74ab10fe6ea
- MD5 20dd82be79a68ae7e8b3c00add17e9a2
- SHA1 de58bf79d66ec42afd68953da4caefae200b26bf
- SHA512 1c6fadf182736df4cf5956abbc26a2743bad29ab783b5e6c3bd8fe482be6ffcbff0c1c036e866a4bc64d2a68d03135b5b8a59f388a197c47d97dfca25a2dbd68
- SSDEEP 384:jzKMZ/X3kXg33txXH86KNxaC56RnMVWm/1u:jzKq33ttcPam6qVx
- TLSH
  T102724A13B2558927EC3102F223CBFBFA679B8500C512D772EBA4CB9D1973A857B38116
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  Cogmind/libpng12-0.dll
- Size 107KB
- SHA256 6c5e8883964af8c67d80189f756856e27fce4ed489e82643219b1c17485fb8b7
- MD5 4f7ee343e306d134cd4915b398c948cb
- SHA1 1ce70ced09830ef46099c4ef45490ca9b6be9f88
- SHA512 22ec645349217a47eb397ca6c3b1e5b3ef9b7b5be9c36d7bf4d9e47e96b8b39586dd63f8b4eb14766a82e23fc7fdff39df21dd55e872afa70d348e76090da4db
- SSDEEP 1536:yvnbTAn91NtdIAI5DXRl0jNdamox44QbTWE/O3jIbbh4u5PJZHneZpsbe:y/An7NtWAIp30JdqSTF/O3mZNzHneZp
- TLSH
  T1E5B36CA3F520C4B2F5E20239D5BF6FB99E7D1A172329D6E3169448E0F9645E7E038360
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  Cogmind/libsodium.dll
- Size 311KB
- SHA256 90b5952bb3a3cd3746b39cb0f77c1f53e4069eb8be2a4e760715310c1f54de3d
- MD5 9ab3e750ac43d3e05c6b74227a5aa43a
- SHA1 9c8d2a75c9fbfb7c28aac499f544d7f5da1a0593
- SHA512 8cfde2d719c4f75f2535c90c4ad0dcc4e23a1163f6a4b458c59ee5acb192dcd1cbaf2b02f106b339c56c65925d74fe42a9da8f5995db0c6464000d08e2d994d4
- SSDEEP 6144:BrktrCiFAm9yVUS55ESEKVLjAtwE/HZpCTvOsyW/bEYiiw0XILx51KMtsjRASM9f:BrktrCiFAm9yVUS55ESEyLjAtwE/HZCm
- TLSH
  T1D9643AA2E964B5A9E4D228B583BFC5E279344B3803D431F3E7452DCEA4771D29138B1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  Cogmind/libvorbis-0.dll
- Size 154KB
- SHA256 e9a632cb71f44d99da9ea2f829ee2b45687dd0a978b9c4586e7a72ddbbd355eb
- MD5 94da46fc04cccd3279a1dbfc9fbf7d53
- SHA1 bb7ba067cbd621b19d21aa02398efaf02f1ec9d2
- SHA512 ba4893a237f46086f5d386e87789422cae474ab01254c3106bc9a936a543f53b9d1ce7fbfd06d816bb4fb5f57e8e2a07e1d4f0b9db7db547d08e57c05be70450
- SSDEEP 1536:5HYKpnDPQ1bZNcozr+hldKTOpb5nNAiIQAMIpUtpQz1iTNLPPUsXxTTLRazIxire:9pnD0CldKal5nVIhhVoJcI9RtO8
- TLSH
  T1D9F37D19F81290BED4F7A131508FBABFE4256B3C83608C67AF4E59F8E626F505D8E141
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  Cogmind/libvorbisfile-3.dll
- Size 33KB
- SHA256 c48fba675c220f31164cb357da9907be8b94e0e50085c3d7ebb099e31e0cbe63
- MD5 232f86229fa7cd82356144d91f457e2c
- SHA1 365416b5932337ad16a1ea92cd8a371a290ac041
- SHA512 18ed110b34ac064102007e98c9bdefef29779255d95a13a8714fe4e2783213da63107f6aedf911d60de01de140559d7076cf0e678a8f3d551e5cc7ba62fc1ac2
- SSDEEP 768:sn8tib1iowF1T959okkw8aiwWM6QdaIF8qXMsjA:A8cb1d+b5iVwjaiA
- TLSH
  T1FEF2194AF90BD0F2E572E63088CAE77BD6518D658423D5B7FF0A474CF93BA46550E042
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  Cogmind/manual.txt
- Size 191KB
- SHA256 15e3bbdb49ba58c9323b30ae8082dfca99efbca09c02c06ec027892c8cf4e226
- MD5 d979c29422302ff4b36106484e8ec00f
- SHA1 c9dab63a8ca848df18b8be5f7bbde9f3d284342f
- SHA512 f035ef6fb6c0e7936cfa890efb48353d39f54f0bddb57893ab6d6459890e04a3dc950b42bf8852aa5c2a4c033832bd0491efb8b7a93a46bfe7fa96dbf1606257
- SSDEEP 3072:iDVJNGhAZqAPxSzgMzD3d1G3PhkdInv6e/vKMZO:yVzGh5YxNI3PcnBvK6O
- TLSH
  T118142A177F4523720693C292364E62E6E73980BC137656A1B4AEC06C33578B643BF6ED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10

ransomware
behavioral29 behavioral30
- Target
  Cogmind/physfs.dll
- Size 114KB
- SHA256 6cae6aa7d84a562dd6735304c7b5a195dd930ba233f174cb71b6d929a5c39ebc
- MD5 c4db56462da6cb66e091c4c6a381623b
- SHA1 4b88de024ebfcf712161bc41b83b4f6f6e4c13eb
- SHA512 a08fc00d00a308011768e22ccdd65c99917084124123c94bb3e8c6913ab882c15a20208576d72031dbe0811d92293d3ff5073606dda4b4fafd37023d93d9cf92
- SSDEEP 1536:odvUud2ltjYfY3CGCH/on30L7Ck9FYX9M4Q42kKfvMSAWN45Rz+nToIf/IODIOyI:iPBvonK7Ck9FYA4efdbN45MTBfxlyd+
- TLSH
  T121B39D00FEC0A4B2D0FD067945D616995FFFFA1886A1964B8B1C08C9ED562B2DF983C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32