Analysis
- max time kernel
150s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/08/2026, 03:10
Behavioral task
behavioral1
Sample
d42ac1d0d8a9c4852f6b6540d834402b98c3c74495f9d420442814e49dd25f98.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
d42ac1d0d8a9c4852f6b6540d834402b98c3c74495f9d420442814e49dd25f98.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target d42ac1d0d8a9c4852f6b6540d834402b98c3c74495f9d420442814e49dd25f98.exe
- Size 3.6MB
- Sample260824-dn88basejc
- SHA256 d42ac1d0d8a9c4852f6b6540d834402b98c3c74495f9d420442814e49dd25f98
- MD5 af243a90bb67bd8c248f5d59e46cd1e5
- SHA1 9a941d4faf558bd81306626d34d8d556fa559786
- SHA512 e77a24ebaf45d370dc225c44a087617449e697f922c8039ffce38f5eaca656b82ec11b0377cc327aea65c6fff06fb3e9297a44b1c780025ae16293be1b13bafc
- SSDEEP 49152:rbf24pOK123wBa1c603wsZga2udET1I+51Oj1CvTA+GG6OT75XvPWzAcbYJyXz5p:rzqEv60gsOTGMN6bbjNCZia56g65PRb
- TLSH T196066CB9BA7CB5749440586BB76DAB43DC0C0D4233949B68517E81B4CE98FE0C849FEE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/memory/2952-0-0x0000000000400000-0x0000000000407000-memory.dmp family_cosmu behavioral2/files/0x0007000000011394-2.dat family_cosmu behavioral2/files/0x000400000001b1b9-6.dat family_cosmu behavioral2/memory/2952-110-0x0000000000400000-0x0000000000407000-memory.dmp family_cosmu - Renames multiple (568) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\7-zip.dll.tmp d42ac1d0d8a9c4852f6b6540d834402b98c3c74495f9d420442814e49dd25f98.exe File created C:\Program Files\7-Zip\Lang\sa.txt.tmp d42ac1d0d8a9c4852f6b6540d834402b98c3c74495f9d420442814e49dd25f98.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.tmp d42ac1d0d8a9c4852f6b6540d834402b98c3c74495f9d420442814e49dd25f98.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui.tmp d42ac1d0d8a9c4852f6b6540d834402b98c3c74495f9d420442814e49dd25f98.exe File created C:\Program Files\Common Files\microsoft shared\ink\lt-LT\tipresx.dll.mui.tmp d42ac1d0d8a9c4852f6b6540d834402b98c3c74495f9d420442814e49dd25f98.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msdaremr.dll.mui.tmp d42ac1d0d8a9c4852f6b6540d834402b98c3c74495f9d420442814e49dd25f98.exe File created C:\Program Files\CompleteOptimize.svgz.tmp d42ac1d0d8a9c4852f6b6540d834402b98c3c74495f9d420442814e49dd25f98.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-filesystem-l1-1-0.dll.tmp d42ac1d0d8a9c4852f6b6540d834402b98c3c74495f9d420442814e49dd25f98.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp120.dll.tmp d42ac1d0d8a9c4852f6b6540d834402b98c3c74495f9d420442814e49dd25f98.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad.xml.tmp d42ac1d0d8a9c4852f6b6540d834402b98c3c74495f9d420442814e49dd25f98.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\vstoee.dll.tmp d42ac1d0d8a9c4852f6b6540d834402b98c3c74495f9d420442814e49dd25f98.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msaddsr.dll.mui.tmp d42ac1d0d8a9c4852f6b6540d834402b98c3c74495f9d420442814e49dd25f98.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Configuration.dll.tmp d42ac1d0d8a9c4852f6b6540d834402b98c3c74495f9d420442814e49dd25f98.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Http.dll.tmp d42ac1d0d8a9c4852f6b6540d834402b98c3c74495f9d420442814e49dd25f98.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebProxy.dll.tmp d42ac1d0d8a9c4852f6b6540d834402b98c3c74495f9d420442814e49dd25f98.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.CompilerServices.Unsafe.dll.tmp d42ac1d0d8a9c4852f6b6540d834402b98c3c74495f9d420442814e49dd25f98.exe File created C:\Program Files\7-Zip\Lang\ta.txt.tmp d42ac1d0d8a9c4852f6b6540d834402b98c3c74495f9d420442814e49dd25f98.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-br.dll.tmp d42ac1d0d8a9c4852f6b6540d834402b98c3c74495f9d420442814e49dd25f98.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml.tmp d42ac1d0d8a9c4852f6b6540d834402b98c3c74495f9d420442814e49dd25f98.exe File created C:\Program Files\Common Files\microsoft shared\ink\mi-NZ\tipresx.dll.mui.tmp d42ac1d0d8a9c4852f6b6540d834402b98c3c74495f9d420442814e49dd25f98.exe File created C:\Program Files\Common Files\System\ado\msado20.tlb.tmp d42ac1d0d8a9c4852f6b6540d834402b98c3c74495f9d420442814e49dd25f98.exe File created C:\Program Files\7-Zip\Lang\mk.txt.tmp d42ac1d0d8a9c4852f6b6540d834402b98c3c74495f9d420442814e49dd25f98.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\clrjit.dll.tmp d42ac1d0d8a9c4852f6b6540d834402b98c3c74495f9d420442814e49dd25f98.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.NameResolution.dll.tmp d42ac1d0d8a9c4852f6b6540d834402b98c3c74495f9d420442814e49dd25f98.exe File created C:\Program Files\Common Files\microsoft shared\ink\bs-Latn-BA\tipresx.dll.mui.tmp d42ac1d0d8a9c4852f6b6540d834402b98c3c74495f9d420442814e49dd25f98.exe File created C:\Program Files\Common Files\microsoft shared\VC\msdia100.dll.tmp d42ac1d0d8a9c4852f6b6540d834402b98c3c74495f9d420442814e49dd25f98.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msdaremr.dll.mui.tmp d42ac1d0d8a9c4852f6b6540d834402b98c3c74495f9d420442814e49dd25f98.exe File created C:\Program Files\7-Zip\Lang\io.txt.tmp d42ac1d0d8a9c4852f6b6540d834402b98c3c74495f9d420442814e49dd25f98.exe File created C:\Program Files\7-Zip\Lang\ar.txt.tmp d42ac1d0d8a9c4852f6b6540d834402b98c3c74495f9d420442814e49dd25f98.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp140.dll.tmp d42ac1d0d8a9c4852f6b6540d834402b98c3c74495f9d420442814e49dd25f98.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\SharedPerformance.man.tmp d42ac1d0d8a9c4852f6b6540d834402b98c3c74495f9d420442814e49dd25f98.exe File created C:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui.tmp d42ac1d0d8a9c4852f6b6540d834402b98c3c74495f9d420442814e49dd25f98.exe File created C:\Program Files\Common Files\System\ado\msadox28.tlb.tmp d42ac1d0d8a9c4852f6b6540d834402b98c3c74495f9d420442814e49dd25f98.exe File created C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui.tmp d42ac1d0d8a9c4852f6b6540d834402b98c3c74495f9d420442814e49dd25f98.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.EventBasedAsync.dll.tmp d42ac1d0d8a9c4852f6b6540d834402b98c3c74495f9d420442814e49dd25f98.exe File created C:\Program Files\7-Zip\Lang\sk.txt.tmp d42ac1d0d8a9c4852f6b6540d834402b98c3c74495f9d420442814e49dd25f98.exe File created C:\Program Files\7-Zip\Lang\zh-cn.txt.tmp d42ac1d0d8a9c4852f6b6540d834402b98c3c74495f9d420442814e49dd25f98.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fi-fi.dll.tmp d42ac1d0d8a9c4852f6b6540d834402b98c3c74495f9d420442814e49dd25f98.exe File created C:\Program Files\Common Files\microsoft shared\ink\km-KH\tipresx.dll.mui.tmp d42ac1d0d8a9c4852f6b6540d834402b98c3c74495f9d420442814e49dd25f98.exe File created C:\Program Files\Common Files\System\ado\msado21.tlb.tmp d42ac1d0d8a9c4852f6b6540d834402b98c3c74495f9d420442814e49dd25f98.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-heap-l1-1-0.dll.tmp d42ac1d0d8a9c4852f6b6540d834402b98c3c74495f9d420442814e49dd25f98.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-heap-l1-1-0.dll.tmp d42ac1d0d8a9c4852f6b6540d834402b98c3c74495f9d420442814e49dd25f98.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.AppContext.dll.tmp d42ac1d0d8a9c4852f6b6540d834402b98c3c74495f9d420442814e49dd25f98.exe File created C:\Program Files\7-Zip\7-zip32.dll.tmp d42ac1d0d8a9c4852f6b6540d834402b98c3c74495f9d420442814e49dd25f98.exe File created C:\Program Files\7-Zip\Lang\sq.txt.tmp d42ac1d0d8a9c4852f6b6540d834402b98c3c74495f9d420442814e49dd25f98.exe File created C:\Program Files\Common Files\microsoft shared\ink\micaut.dll.tmp d42ac1d0d8a9c4852f6b6540d834402b98c3c74495f9d420442814e49dd25f98.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-handle-l1-1-0.dll.tmp d42ac1d0d8a9c4852f6b6540d834402b98c3c74495f9d420442814e49dd25f98.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Process.dll.tmp d42ac1d0d8a9c4852f6b6540d834402b98c3c74495f9d420442814e49dd25f98.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.dll.tmp d42ac1d0d8a9c4852f6b6540d834402b98c3c74495f9d420442814e49dd25f98.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.AccessControl.dll.tmp d42ac1d0d8a9c4852f6b6540d834402b98c3c74495f9d420442814e49dd25f98.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Claims.dll.tmp d42ac1d0d8a9c4852f6b6540d834402b98c3c74495f9d420442814e49dd25f98.exe File created C:\Program Files\7-Zip\7zG.exe.tmp d42ac1d0d8a9c4852f6b6540d834402b98c3c74495f9d420442814e49dd25f98.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll.tmp d42ac1d0d8a9c4852f6b6540d834402b98c3c74495f9d420442814e49dd25f98.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll.tmp d42ac1d0d8a9c4852f6b6540d834402b98c3c74495f9d420442814e49dd25f98.exe File created C:\Program Files\Common Files\microsoft shared\ink\mk-MK\tipresx.dll.mui.tmp d42ac1d0d8a9c4852f6b6540d834402b98c3c74495f9d420442814e49dd25f98.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Security.dll.tmp d42ac1d0d8a9c4852f6b6540d834402b98c3c74495f9d420442814e49dd25f98.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Principal.Windows.dll.tmp d42ac1d0d8a9c4852f6b6540d834402b98c3c74495f9d420442814e49dd25f98.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Parallel.dll.tmp d42ac1d0d8a9c4852f6b6540d834402b98c3c74495f9d420442814e49dd25f98.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Console.dll.tmp d42ac1d0d8a9c4852f6b6540d834402b98c3c74495f9d420442814e49dd25f98.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ar-sa.dll.tmp d42ac1d0d8a9c4852f6b6540d834402b98c3c74495f9d420442814e49dd25f98.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.et-ee.dll.tmp d42ac1d0d8a9c4852f6b6540d834402b98c3c74495f9d420442814e49dd25f98.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll.tmp d42ac1d0d8a9c4852f6b6540d834402b98c3c74495f9d420442814e49dd25f98.exe File created C:\Program Files\Common Files\microsoft shared\ink\ar-SA\tipresx.dll.mui.tmp d42ac1d0d8a9c4852f6b6540d834402b98c3c74495f9d420442814e49dd25f98.exe File created C:\Program Files\Common Files\microsoft shared\ink\bg-BG\tipresx.dll.mui.tmp d42ac1d0d8a9c4852f6b6540d834402b98c3c74495f9d420442814e49dd25f98.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d42ac1d0d8a9c4852f6b6540d834402b98c3c74495f9d420442814e49dd25f98.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d42ac1d0d8a9c4852f6b6540d834402b98c3c74495f9d420442814e49dd25f98.exe"C:\Users\Admin\AppData\Local\Temp\d42ac1d0d8a9c4852f6b6540d834402b98c3c74495f9d420442814e49dd25f98.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2952
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3989226554-2204910950-1522900112-1000\desktop.ini.tmp
- Size 3.6MB
- SHA256 195a9a4d02cef87a46e47007c975b417a7de177248854032a3486a721d79c935
- MD5 b711b85f6ae2650b0bcc942e073a15bf
- SHA1 66dfc17a7bf7e4e702494f45f1d7782eb9b360b3
- SHA512 ef9c61b3271f6a8ad84a120ef8d8e5cc4a0a5fa4af4c68df1435ba50880ac6d1c2bc97f01d564109a59e55cad23933c2ebc2c60c475ded816c9340ae950cb779
- SSDEEP 49152:rbf24pOK123wBa1c603wsZga2udET1I+51Oj1CvTA+GG6OT75XvPWzAcbYJyXz5+:rzqEv60gsOTGMN6bbjNCZia56g65PRU
- TLSH T17C066CB9BA7CB5749440586BB76DAB43DC0C0D4233949B68517E81B4CE98FE0C849FEE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 3.7MB
- SHA256 4171d1848857271e86ad223fea796fea4258a5f6caba4b0090601d960b20f5d5
- MD5 f869fa29c0b25bd8b696545a168f21bc
- SHA1 8ce00da30fa59faadd82c5e04493d79b55664948
- SHA512 3ce6eac49f2fd78d9e0758b8e8c4e44ae456bf79a22110a498986d46cdadb88e1e85472d55003f00047a8a325d5c99146ed6d320ef51e5fd1407c41d951ebf7a
- SSDEEP 49152:rbf24pOK123wBa1c603wsZga2udET1I+51Oj1CvTA+GG6OT75XvPWzAcbYJyXz5U:rzqEv60gsOTGMN6bbjNCZia56g65PRe
- TLSH T152066CB9BA7CB574D440586BB65EAF43DC0C0D423B948B68517E81B48E58FE0C849FEE
- MD5 SHA1 SHA512 SSDEEP TLSH