General
- Target Cosmic-UI.exe
- Size 16.2MB
- Sample260702-ryf66sds5r
- SHA256 22c126f7eec588ee722f5474b1a9520e64fe6fa8d51448234e6e7906bf3ede2f
- MD5 aaa2f3b63451b9c651279f227b97fdd7
- SHA1 e92f161641650ad08d79a3e1b02dda9e358576c3
- SHA512 9c916ebc43fb683b64eb7c8a4314bd6b5ee5d36e8ade1c80445ec7dbb14a9297502d495f5390695e9694ed190a12e42d7d5f8746edd942142bfebc3e6a0743f4
- SSDEEP 196608:arXVG3JHAFzmqXKC8V6Faaya8l0S7oxT8TSfg2lhu:oXVG3JgF3Z46FaayFsxT8TSfg4h
- TLSH T14B0706217B5A996DC05BC474834B8B724A7130CA0B39B9FF449496383F6ABF46F38359
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Cosmic-UI.exe
Resource
win10v2004-20260513-en
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
Cosmic-UI.exe
Resource
win11ltsc2024-20260629-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target Cosmic-UI.exe
- Size 16.2MB
- SHA256 22c126f7eec588ee722f5474b1a9520e64fe6fa8d51448234e6e7906bf3ede2f
- MD5 aaa2f3b63451b9c651279f227b97fdd7
- SHA1 e92f161641650ad08d79a3e1b02dda9e358576c3
- SHA512 9c916ebc43fb683b64eb7c8a4314bd6b5ee5d36e8ade1c80445ec7dbb14a9297502d495f5390695e9694ed190a12e42d7d5f8746edd942142bfebc3e6a0743f4
- SSDEEP 196608:arXVG3JHAFzmqXKC8V6Faaya8l0S7oxT8TSfg2lhu:oXVG3JgF3Z46FaayFsxT8TSfg4h
- TLSH T14B0706217B5A996DC05BC474834B8B724A7130CA0B39B9FF449496383F6ABF46F38359
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Executes dropped EXE
-
Checks whether UAC is enabled
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Enumerates processes with tasklist