Analysis
- max time kernel
150s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/07/2026, 13:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4b91095bc39063e831da36f9dfa76fc7d6ba17235bbcf3b345eebfb65adc00d9.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
4b91095bc39063e831da36f9dfa76fc7d6ba17235bbcf3b345eebfb65adc00d9.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 4b91095bc39063e831da36f9dfa76fc7d6ba17235bbcf3b345eebfb65adc00d9.exe
- Size 12.5MB
- Sample260722-qfrdrafb28
- SHA256 4b91095bc39063e831da36f9dfa76fc7d6ba17235bbcf3b345eebfb65adc00d9
- MD5 9cc46a8e1f6011dcab32c5536ca18bcd
- SHA1 a736dd7aa615f35c0c5faea0882b0321018ef30e
- SHA512 243a582d83804505a9e8f78a6ea4fa90884da302424d24033e425d805dd02485a857b437f2ccc944f3a70014ae1223a97e3244b799675bdd11111870b14bfe3e
- SSDEEP 98304:rzqEv60gsOTGMN6bbjNCZia56g65PRdKNtMGMnRzBrpFSqLsO86msAeN75jJW5Bw:rE0XQGMN6bbMLP+2zqqGGEt
- TLSH T15AD639BE6F64FC609880AC52D9B2CE50DD8F5C827199C430857EF9608E44ED1CDADAB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 2 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/memory/2944-0-0x0000000000400000-0x0000000000407000-memory.dmp family_cosmu behavioral2/memory/2944-34-0x0000000000400000-0x0000000000407000-memory.dmp family_cosmu - Renames multiple (221) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\Lang\mn.txt.tmp 4b91095bc39063e831da36f9dfa76fc7d6ba17235bbcf3b345eebfb65adc00d9.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.tmp 4b91095bc39063e831da36f9dfa76fc7d6ba17235bbcf3b345eebfb65adc00d9.exe File created C:\Program Files\7-Zip\Lang\fr.txt.tmp 4b91095bc39063e831da36f9dfa76fc7d6ba17235bbcf3b345eebfb65adc00d9.exe File created C:\Program Files\7-Zip\Lang\ky.txt.tmp 4b91095bc39063e831da36f9dfa76fc7d6ba17235bbcf3b345eebfb65adc00d9.exe File created C:\Program Files\7-Zip\Lang\ro.txt.tmp 4b91095bc39063e831da36f9dfa76fc7d6ba17235bbcf3b345eebfb65adc00d9.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\TabTip.exe.mui.tmp 4b91095bc39063e831da36f9dfa76fc7d6ba17235bbcf3b345eebfb65adc00d9.exe File created C:\Program Files\7-Zip\Lang\hr.txt.tmp 4b91095bc39063e831da36f9dfa76fc7d6ba17235bbcf3b345eebfb65adc00d9.exe File created C:\Program Files\7-Zip\Lang\ka.txt.tmp 4b91095bc39063e831da36f9dfa76fc7d6ba17235bbcf3b345eebfb65adc00d9.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.tmp 4b91095bc39063e831da36f9dfa76fc7d6ba17235bbcf3b345eebfb65adc00d9.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hi-in.dll.tmp 4b91095bc39063e831da36f9dfa76fc7d6ba17235bbcf3b345eebfb65adc00d9.exe File created C:\Program Files\7-Zip\7z.dll.tmp 4b91095bc39063e831da36f9dfa76fc7d6ba17235bbcf3b345eebfb65adc00d9.exe File created C:\Program Files\7-Zip\Lang\da.txt.tmp 4b91095bc39063e831da36f9dfa76fc7d6ba17235bbcf3b345eebfb65adc00d9.exe File created C:\Program Files\7-Zip\Lang\kab.txt.tmp 4b91095bc39063e831da36f9dfa76fc7d6ba17235bbcf3b345eebfb65adc00d9.exe File created C:\Program Files\7-Zip\Lang\si.txt.tmp 4b91095bc39063e831da36f9dfa76fc7d6ba17235bbcf3b345eebfb65adc00d9.exe File created C:\Program Files\7-Zip\Lang\ug.txt.tmp 4b91095bc39063e831da36f9dfa76fc7d6ba17235bbcf3b345eebfb65adc00d9.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll.tmp 4b91095bc39063e831da36f9dfa76fc7d6ba17235bbcf3b345eebfb65adc00d9.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-pt.dll.tmp 4b91095bc39063e831da36f9dfa76fc7d6ba17235bbcf3b345eebfb65adc00d9.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientCapabilities.json.tmp 4b91095bc39063e831da36f9dfa76fc7d6ba17235bbcf3b345eebfb65adc00d9.exe File created C:\Program Files\7-Zip\Lang\an.txt.tmp 4b91095bc39063e831da36f9dfa76fc7d6ba17235bbcf3b345eebfb65adc00d9.exe File created C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp 4b91095bc39063e831da36f9dfa76fc7d6ba17235bbcf3b345eebfb65adc00d9.exe File created C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp 4b91095bc39063e831da36f9dfa76fc7d6ba17235bbcf3b345eebfb65adc00d9.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll.tmp 4b91095bc39063e831da36f9dfa76fc7d6ba17235bbcf3b345eebfb65adc00d9.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hr-hr.dll.tmp 4b91095bc39063e831da36f9dfa76fc7d6ba17235bbcf3b345eebfb65adc00d9.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sr-latn-rs.dll.tmp 4b91095bc39063e831da36f9dfa76fc7d6ba17235bbcf3b345eebfb65adc00d9.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man.tmp 4b91095bc39063e831da36f9dfa76fc7d6ba17235bbcf3b345eebfb65adc00d9.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp120.dll.tmp 4b91095bc39063e831da36f9dfa76fc7d6ba17235bbcf3b345eebfb65adc00d9.exe File created C:\Program Files\7-Zip\Lang\br.txt.tmp 4b91095bc39063e831da36f9dfa76fc7d6ba17235bbcf3b345eebfb65adc00d9.exe File created C:\Program Files\7-Zip\Lang\nn.txt.tmp 4b91095bc39063e831da36f9dfa76fc7d6ba17235bbcf3b345eebfb65adc00d9.exe File created C:\Program Files\7-Zip\Lang\sa.txt.tmp 4b91095bc39063e831da36f9dfa76fc7d6ba17235bbcf3b345eebfb65adc00d9.exe File created C:\Program Files\7-Zip\Lang\tr.txt.tmp 4b91095bc39063e831da36f9dfa76fc7d6ba17235bbcf3b345eebfb65adc00d9.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ru-ru.dll.tmp 4b91095bc39063e831da36f9dfa76fc7d6ba17235bbcf3b345eebfb65adc00d9.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140.dll.tmp 4b91095bc39063e831da36f9dfa76fc7d6ba17235bbcf3b345eebfb65adc00d9.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcr120.dll.tmp 4b91095bc39063e831da36f9dfa76fc7d6ba17235bbcf3b345eebfb65adc00d9.exe File created C:\Program Files\Common Files\microsoft shared\ink\bn-IN\tipresx.dll.mui.tmp 4b91095bc39063e831da36f9dfa76fc7d6ba17235bbcf3b345eebfb65adc00d9.exe File created C:\Program Files\7-Zip\Lang\ast.txt.tmp 4b91095bc39063e831da36f9dfa76fc7d6ba17235bbcf3b345eebfb65adc00d9.exe File created C:\Program Files\7-Zip\Lang\fa.txt.tmp 4b91095bc39063e831da36f9dfa76fc7d6ba17235bbcf3b345eebfb65adc00d9.exe File created C:\Program Files\7-Zip\Lang\id.txt.tmp 4b91095bc39063e831da36f9dfa76fc7d6ba17235bbcf3b345eebfb65adc00d9.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lt-lt.dll.tmp 4b91095bc39063e831da36f9dfa76fc7d6ba17235bbcf3b345eebfb65adc00d9.exe File created C:\Program Files\Common Files\microsoft shared\ink\cy-GB\tipresx.dll.mui.tmp 4b91095bc39063e831da36f9dfa76fc7d6ba17235bbcf3b345eebfb65adc00d9.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui.tmp 4b91095bc39063e831da36f9dfa76fc7d6ba17235bbcf3b345eebfb65adc00d9.exe File created C:\Program Files\7-Zip\Lang\el.txt.tmp 4b91095bc39063e831da36f9dfa76fc7d6ba17235bbcf3b345eebfb65adc00d9.exe File created C:\Program Files\7-Zip\Lang\pt.txt.tmp 4b91095bc39063e831da36f9dfa76fc7d6ba17235bbcf3b345eebfb65adc00d9.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll.tmp 4b91095bc39063e831da36f9dfa76fc7d6ba17235bbcf3b345eebfb65adc00d9.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll.tmp 4b91095bc39063e831da36f9dfa76fc7d6ba17235bbcf3b345eebfb65adc00d9.exe File created C:\Program Files\Common Files\microsoft shared\ink\ca-ES\tipresx.dll.mui.tmp 4b91095bc39063e831da36f9dfa76fc7d6ba17235bbcf3b345eebfb65adc00d9.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\tipresx.dll.mui.tmp 4b91095bc39063e831da36f9dfa76fc7d6ba17235bbcf3b345eebfb65adc00d9.exe File created C:\Program Files\7-Zip\Lang\is.txt.tmp 4b91095bc39063e831da36f9dfa76fc7d6ba17235bbcf3b345eebfb65adc00d9.exe File created C:\Program Files\7-Zip\Lang\lt.txt.tmp 4b91095bc39063e831da36f9dfa76fc7d6ba17235bbcf3b345eebfb65adc00d9.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClient.man.tmp 4b91095bc39063e831da36f9dfa76fc7d6ba17235bbcf3b345eebfb65adc00d9.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.he-il.dll.tmp 4b91095bc39063e831da36f9dfa76fc7d6ba17235bbcf3b345eebfb65adc00d9.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\FrequentOfficeUpdateSchedule.xml.tmp 4b91095bc39063e831da36f9dfa76fc7d6ba17235bbcf3b345eebfb65adc00d9.exe File created C:\Program Files\Common Files\microsoft shared\ink\be-BY\tipresx.dll.mui.tmp 4b91095bc39063e831da36f9dfa76fc7d6ba17235bbcf3b345eebfb65adc00d9.exe File created C:\Program Files\7-Zip\Lang\bg.txt.tmp 4b91095bc39063e831da36f9dfa76fc7d6ba17235bbcf3b345eebfb65adc00d9.exe File created C:\Program Files\7-Zip\Lang\va.txt.tmp 4b91095bc39063e831da36f9dfa76fc7d6ba17235bbcf3b345eebfb65adc00d9.exe File created C:\Program Files\7-Zip\Lang\gl.txt.tmp 4b91095bc39063e831da36f9dfa76fc7d6ba17235bbcf3b345eebfb65adc00d9.exe File created C:\Program Files\7-Zip\Lang\mng2.txt.tmp 4b91095bc39063e831da36f9dfa76fc7d6ba17235bbcf3b345eebfb65adc00d9.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.cs-cz.dll.tmp 4b91095bc39063e831da36f9dfa76fc7d6ba17235bbcf3b345eebfb65adc00d9.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sk-sk.dll.tmp 4b91095bc39063e831da36f9dfa76fc7d6ba17235bbcf3b345eebfb65adc00d9.exe File created C:\Program Files\7-Zip\Lang\af.txt.tmp 4b91095bc39063e831da36f9dfa76fc7d6ba17235bbcf3b345eebfb65adc00d9.exe File created C:\Program Files\7-Zip\Lang\fy.txt.tmp 4b91095bc39063e831da36f9dfa76fc7d6ba17235bbcf3b345eebfb65adc00d9.exe File created C:\Program Files\7-Zip\Lang\tt.txt.tmp 4b91095bc39063e831da36f9dfa76fc7d6ba17235bbcf3b345eebfb65adc00d9.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll.tmp 4b91095bc39063e831da36f9dfa76fc7d6ba17235bbcf3b345eebfb65adc00d9.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-br.dll.tmp 4b91095bc39063e831da36f9dfa76fc7d6ba17235bbcf3b345eebfb65adc00d9.exe File created C:\Program Files\7-Zip\descript.ion.tmp 4b91095bc39063e831da36f9dfa76fc7d6ba17235bbcf3b345eebfb65adc00d9.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4b91095bc39063e831da36f9dfa76fc7d6ba17235bbcf3b345eebfb65adc00d9.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4b91095bc39063e831da36f9dfa76fc7d6ba17235bbcf3b345eebfb65adc00d9.exe"C:\Users\Admin\AppData\Local\Temp\4b91095bc39063e831da36f9dfa76fc7d6ba17235bbcf3b345eebfb65adc00d9.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2944
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini.tmp
- Size 12.5MB
- SHA256 22bccbac72ff411c660d51bdb0c0e762ffc92e30e6c15d7220b2e7c4c3e8bec2
- MD5 64066c294ff6869779e53aaf8d8ba72f
- SHA1 752cdf9bda0162786b5f923761228a6467d3eeec
- SHA512 9759a27d25f33904ed34210a8191d694e130f14f695ba849d4e9ea4138bf02b4d5b6a2a518f3027a3d355827afc48aac7f64195716724038ecb12c5e30cb0da1
- SSDEEP 98304:rzqEv60gsOTGMN6bbjNCZia56g65PRdKNtMGMnRzBrpFSqLsO86msAeN75jJW5BR:rE0XQGMN6bbMLP+2zqqGGEE
- TLSH T17BD639BE6F64FC609880AC52D9B2CE50DD8F5C827199C430857EF9608E44ED1CDADAB7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 12.6MB
- SHA256 281c96e09933367ab8fbbe556eaad85717a7fdb883448fdb98b1e2326ae9cb2a
- MD5 330ad5c1934eeaa1d625fae517953ab9
- SHA1 308c30a9e31e16076a54b42c9676c483a8344500
- SHA512 c6531ff9c0ae4bcbd3eec24243748fbb71bf14bf0098d374bfa197e35022ad5c9682bde44c6ed0041cc83254b4668050211c062f6ef90dfc9abe378481e01132
- SSDEEP 98304:rzqEv60gsOTGMN6bbjNCZia56g65PRdKNtMGMnRzBrpFSqLsO86msAeN75jJW5Bu:rE0XQGMN6bbMLP+2zqqGGEf
- TLSH T1E9D639BE6F64FC608880AC52D9B2CE50DD8F5C827599C430857EF9608E44ED1CDADAB7
- MD5 SHA1 SHA512 SSDEEP TLSH