Overview
overview
10Static
static
10Red-Flaged...3b.exe
windows10-2004-x64
10Red-Flaged...3b.exe
windows11-ltsc_2024-x64
10Red-Flaged...6a.exe
windows10-2004-x64
10Red-Flaged...6a.exe
windows11-ltsc_2024-x64
10Red-Flaged...eb.exe
windows10-2004-x64
10Red-Flaged...eb.exe
windows11-ltsc_2024-x64
10Red-Flaged...02.exe
windows10-2004-x64
10Red-Flaged...02.exe
windows11-ltsc_2024-x64
10Red-Flaged...c5.exe
windows10-2004-x64
10Red-Flaged...c5.exe
windows11-ltsc_2024-x64
10Red-Flaged...37.exe
windows10-2004-x64
10Red-Flaged...37.exe
windows11-ltsc_2024-x64
10Red-Flaged...e7.exe
windows10-2004-x64
10Red-Flaged...e7.exe
windows11-ltsc_2024-x64
10Red-Flaged...64.exe
windows10-2004-x64
8Red-Flaged...64.exe
windows11-ltsc_2024-x64
8Red-Flaged...5d.exe
windows10-2004-x64
10Red-Flaged...5d.exe
windows11-ltsc_2024-x64
10Red-Flaged...d6.exe
windows10-2004-x64
10Red-Flaged...d6.exe
windows11-ltsc_2024-x64
10Red-Flaged...e7.exe
windows10-2004-x64
10Red-Flaged...e7.exe
windows11-ltsc_2024-x64
10Red-Flaged...d8.exe
windows10-2004-x64
10Red-Flaged...d8.exe
windows11-ltsc_2024-x64
10Red-Flaged...55.exe
windows10-2004-x64
10Red-Flaged...55.exe
windows11-ltsc_2024-x64
10Red-Flaged...bc.exe
windows10-2004-x64
10Red-Flaged...bc.exe
windows11-ltsc_2024-x64
10Red-Flaged...6a.exe
windows10-2004-x64
10Red-Flaged...6a.exe
windows11-ltsc_2024-x64
10Red-Flaged...03.exe
windows10-2004-x64
10Red-Flaged...03.exe
windows11-ltsc_2024-x64
10Resubmissions
20/09/2026, 10:36
260920-mnczjsab771020/09/2026, 07:07
260920-hx3jcadp5x1008/09/2026, 15:38
260908-s27nzagd9315/08/2026, 21:05
260815-zw6ytat1ez15/08/2026, 20:50
260815-zmxnsatzgs15/08/2026, 20:46
260815-zkklfatcnf15/08/2026, 20:40
260815-zf5e2stcjb15/08/2026, 20:39
260815-zfqlwstydz14/08/2026, 18:03
260814-wm9fssyyev06/08/2026, 22:09
260806-124lbabl4sAnalysis
- max time kernel
150s - max time network
173s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
12/07/2026, 12:54
Static task
static1
Behavioral task
behavioral1
Sample
Red-Flaged/a2c01011d0a2b5ee0a51fae41109e9ccfe2aae16e6c4212addac7f757f23893b.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
Red-Flaged/a2c01011d0a2b5ee0a51fae41109e9ccfe2aae16e6c4212addac7f757f23893b.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
Red-Flaged/ab036cc442800d2d71a3baa9f2d6b27e3813b9f740d7c3e7635b84e3e7a8d66a.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
Red-Flaged/ab036cc442800d2d71a3baa9f2d6b27e3813b9f740d7c3e7635b84e3e7a8d66a.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
Red-Flaged/aca01073676a7e2003ac7af9b27b9aa54c076ea94cf4c9627828b12955261aeb.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
Red-Flaged/aca01073676a7e2003ac7af9b27b9aa54c076ea94cf4c9627828b12955261aeb.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
Red-Flaged/b0dfaf509de38749c49afcb3cd34d27126044bb77cc16896b02ebced6f95db02.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
Red-Flaged/b0dfaf509de38749c49afcb3cd34d27126044bb77cc16896b02ebced6f95db02.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral9
Sample
Red-Flaged/b2e27be69931b678ee13b42f83438dc5.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
Red-Flaged/b2e27be69931b678ee13b42f83438dc5.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral11
Sample
Red-Flaged/b3da793a00eebaf8987fe2b759369e3d7ff02d91111c219c707bcb9709357637.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
Red-Flaged/b3da793a00eebaf8987fe2b759369e3d7ff02d91111c219c707bcb9709357637.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral13
Sample
Red-Flaged/b8e71845cc8ccd668a3436d1952a6c57649974bb8399e599dc33afc4c0843be7.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
Red-Flaged/b8e71845cc8ccd668a3436d1952a6c57649974bb8399e599dc33afc4c0843be7.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral15
Sample
Red-Flaged/bfb39f486372a509f307cde3361795a2f9f759cbeb4cac07562dcbaebc070364.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
Red-Flaged/bfb39f486372a509f307cde3361795a2f9f759cbeb4cac07562dcbaebc070364.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral17
Sample
Red-Flaged/c43a34e78ba6913551af41857fb63a3545acd6a9248e8a4de884988b3ccf895d.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
Red-Flaged/c43a34e78ba6913551af41857fb63a3545acd6a9248e8a4de884988b3ccf895d.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral19
Sample
Red-Flaged/c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
Red-Flaged/c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral21
Sample
Red-Flaged/c5f49c0f566a114b529138f8bd222865c9fa9fa95f96ec1ded50700764a1d4e7.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
Red-Flaged/c5f49c0f566a114b529138f8bd222865c9fa9fa95f96ec1ded50700764a1d4e7.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
Behavioral task
behavioral23
Sample
Red-Flaged/c9fd60a7a3974913a39a4dcdad4b4ccaeb93b614741af2eb7ee0d892130689d8.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
Red-Flaged/c9fd60a7a3974913a39a4dcdad4b4ccaeb93b614741af2eb7ee0d892130689d8.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
Behavioral task
behavioral25
Sample
Red-Flaged/d60dc6965f6d68a3e7c82d42e90bfda7ad3c5874d2c59a66df6212aef027b455.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
Red-Flaged/d60dc6965f6d68a3e7c82d42e90bfda7ad3c5874d2c59a66df6212aef027b455.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral27
Sample
Red-Flaged/d8c5d04d859189de3321a635abcd5ddf84f28f04119830402c66527ae36ae3bc.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
Red-Flaged/d8c5d04d859189de3321a635abcd5ddf84f28f04119830402c66527ae36ae3bc.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral29
Sample
Red-Flaged/dc54117b965674bad3d7cd203ecf5e7fc822423a3f692895cf5e96e83fb88f6a.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
Red-Flaged/dc54117b965674bad3d7cd203ecf5e7fc822423a3f692895cf5e96e83fb88f6a.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral31
Sample
Red-Flaged/df5ab9015833023a03f92a797e20196672c1d6525501a9f9a94a45b0904c7403.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
Red-Flaged/df5ab9015833023a03f92a797e20196672c1d6525501a9f9a94a45b0904c7403.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
General
- Target Red-Flaged/c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe
- Size 436KB
- Sample260712-p5a8dsas8k
- SHA256 c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6
- MD5 a59cca1e2762abe6f3518452655e7c32
- SHA1 3302718cffc7454b85df790a61da318b4a93505d
- SHA512 016e09b7895f1fbe814ce395a7277d2e4c09f3168ae86e16de7a1e6cdb6e63d6865beee0d0718b1f76b3cb12310563094c642bd3e02e15abbb25c130b71fa760
- SSDEEP 6144:KbEJIjNDv0bNXkbvLdEJIjNDv0bNXkbvL5:rIZGNXkbvL0IZGNXkbvL5
- TLSH T1A394185069BDFD60EA245279AC537DC392593ECA3F9DCF52B1A188F38438AA51C4B0D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral19/memory/1552-0-0x0000000000400000-0x000000000040B000-memory.dmp family_cosmu behavioral19/files/0x000b0000000242ee-2.dat family_cosmu behavioral19/files/0x000400000002184a-6.dat family_cosmu behavioral19/memory/1552-424-0x0000000000400000-0x000000000040B000-memory.dmp family_cosmu - Renames multiple (2683) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral19/memory/1552-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral19/files/0x000b0000000242ee-2.dat upx behavioral19/files/0x000400000002184a-6.dat upx behavioral19/memory/1552-424-0x0000000000400000-0x000000000040B000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\Lang\uk.txt.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hu-hu.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Data.DataSetExtensions.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\hr.pak.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-debug-l1-1-0.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_sv.properties.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\Java\jre-1.8\bin\jawt.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\Common Files\microsoft shared\ink\th-TH\tipresx.dll.mui.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.NonGeneric.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationTypes.resources.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaSansRegular.ttf.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\dynalink.md.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Dynamic.Runtime.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hans\System.Windows.Input.Manipulations.resources.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\freebxml.md.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\7-Zip\Lang\an.txt.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ValueTuple.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Input.Manipulations.resources.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationUI.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-CA\tipresx.dll.mui.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwrfrash.dat.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwritalm.dat.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.Common.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Numerics.Vectors.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\System.Windows.Forms.resources.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ko\System.Windows.Forms.Primitives.resources.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\Internet Explorer\fr-FR\iexplore.exe.mui.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\Java\jre-1.8\lib\security\java.security.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\Common Files\System\msadc\msadds.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.OpenSsl.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\ReachFramework.resources.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ja\WindowsFormsIntegration.resources.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\default_apps\external_extensions.json.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\Java\jdk-1.8\lib\sa-jdi.jar.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_LinkDrop32x32.gif.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Core.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.DiagnosticSource.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.AccessControl.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationTypes.resources.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Forms.resources.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationClientSideProviders.resources.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\7-Zip\Lang\mng.txt.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\Common Files\System\msadc\adcjavas.inc.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Handles.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Security.AccessControl.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Forms.resources.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\Common Files\System\msadc\adcvbs.inc.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\PresentationUI.resources.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hant\PresentationCore.resources.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightItalic.ttf.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\psfont.properties.ja.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.Primitives.resources.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\PresentationCore.resources.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationCore.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processthreads-l1-1-1.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\Java\jre-1.8\lib\ext\localedata.jar.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Red-Flaged\c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe"C:\Users\Admin\AppData\Local\Temp\Red-Flaged\c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1552
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini.tmp
- Size 436KB
- SHA256 3a085aff88cd552f63cb09a1122680bda75898e271e5eeb5b0a7a4ae888162a3
- MD5 afe6a6e1e625a412d317ca88a750943c
- SHA1 2574d8659a5cdb1964d59c6ddddd4dae6a59d350
- SHA512 f6441a9ade2d75b0b0b460d407d3cbac98326671234883e519dcc5d1d6465f4b29047f93a82b476ccf810829f6f2c944aa4127d22fa73be197d3f45902a42f2f
- SSDEEP 6144:KbEJIjNDv0bNXkbvLdEJIjNDv0bNXkbvLH:rIZGNXkbvL0IZGNXkbvLH
- TLSH T1A094185069BDFD60EA245279AC537DC392593ECA3F9DCF52B1A188F38438AA51C4B0D3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 535KB
- SHA256 2d034e34c2abc20bbae3ba65804bd88244a76d2dcf67a055f7ad82eb9fd8de23
- MD5 a6e3f9230120dfb33613e6912c98e56e
- SHA1 3185eda5c8bdb72ee7f7be10eb4f3f440ffe18ba
- SHA512 a1e871514b306042384eca37b76718481ee930a67cd344b6843619258b3cff0cc949152f90e1c4e3161721602b61d4e12240f81a1e77b07d8e65a1dc5cbc9bf3
- SSDEEP 6144:KbEJIjNDv0bNXkbvLdEJIjNDv0bNXkbvLMMfTinqncsWp+/:rIZGNXkbvL0IZGNXkbvLMMfunbsW8/
- TLSH T1BFC408507DAEFD60EE245279AC537D8392493ACA3E9DCF52B1A188F3843CA951C4B4D3
- MD5 SHA1 SHA512 SSDEEP TLSH