Analysis
- max time kernel
150s - max time network
52s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/08/2026, 22:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a4f43a6f802512ca01c0900c79bee3990d0dec4575617999c4b8eb9449d00bf7.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
a4f43a6f802512ca01c0900c79bee3990d0dec4575617999c4b8eb9449d00bf7.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target a4f43a6f802512ca01c0900c79bee3990d0dec4575617999c4b8eb9449d00bf7.exe
- Size 201KB
- Sample260830-2ht37saq9x
- SHA256 a4f43a6f802512ca01c0900c79bee3990d0dec4575617999c4b8eb9449d00bf7
- MD5 af64c08d04f30efdd8d50d07fb4bd233
- SHA1 6bbd67523d99a361b204c5a906b69c82659b6953
- SHA512 c905f4bacd7417568b949f2d136c6fb722d12b11b720e38596522d8f4237ad1aa005abb886da7b9ddefa180cb601efa309016045f5f484b17982836981341e7d
- SSDEEP 3072:+WpBoIT5orfxDZ5orfxDHQWTSIoXkZA/gwjHnrhtVufJO05m4uvHwog8yT5FoB:XLQWTSIoXNHnr1GJOl4uvjgddFS
- TLSH T1F114382AB39920A9D39AB27881437541E37138625FB477FB03D076760E27EF48E79B11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 2 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/memory/4632-22-0x0000000000400000-0x0000000000406400-memory.dmp family_cosmu behavioral2/memory/4228-577-0x0000000000400000-0x0000000000406400-memory.dmp family_cosmu - Renames multiple (4755) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Executes dropped EXE 2 IoCs
pid Process 5564 _dotnet.exe 4228 Zombie.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Zombie.exe a4f43a6f802512ca01c0900c79bee3990d0dec4575617999c4b8eb9449d00bf7.exe File opened for modification C:\Windows\SysWOW64\Zombie.exe a4f43a6f802512ca01c0900c79bee3990d0dec4575617999c4b8eb9449d00bf7.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial3-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-180.png.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\System.Windows.Input.Manipulations.resources.dll.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\lib\images\cursors\invalid32x32.gif.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Trial-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\TelemetryDashboard.xltx.tmp Zombie.exe File created C:\Program Files\Common Files\System\ado\msadox.dll.tmp Zombie.exe File created C:\Program Files\Common Files\System\Ole DB\ja-JP\sqlxmlx.rll.mui.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.Primitives.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordaccore.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ul-phn.xrm-ms.tmp Zombie.exe File created C:\Program Files\7-Zip\Lang\tt.txt.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Threading.Timer.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\npdeployJava1.dll.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad.xml.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordaccore.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-string-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\bin\prism_common.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-process-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-runtime-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\7-Zip\Lang\ca.txt.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.EventBasedAsync.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clretwrc.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-stdio-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\management\management.properties.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_SubTrial-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\TelemetryLog.xltx.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pidgenx.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\Microsoft.VisualBasic.Forms.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\Microsoft.VisualBasic.Forms.resources.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-synch-l1-2-0.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\SHARING.CFG.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Xaml.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\WindowsBase.resources.dll.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\lib\management-agent.jar.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\XLMACRO.CHM.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\SMIMES.CFG.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-conio-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationCore.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationClientSideProviders.resources.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql120.xsl.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\IPMS.ICO.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Drawing.Design.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jli.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTrial-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\MSSPC.ECF.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-140.png.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.cab.cat.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Collections.Specialized.dll.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml.tmp Zombie.exe File created C:\Program Files\Common Files\System\ado\msado25.tlb.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-memory-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Wisp.thmx.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\OMSMMS.CFG.tmp Zombie.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a4f43a6f802512ca01c0900c79bee3990d0dec4575617999c4b8eb9449d00bf7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Zombie.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4632 wrote to memory of 5564 4632 a4f43a6f802512ca01c0900c79bee3990d0dec4575617999c4b8eb9449d00bf7.exe 89 PID 4632 wrote to memory of 4228 4632 a4f43a6f802512ca01c0900c79bee3990d0dec4575617999c4b8eb9449d00bf7.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\a4f43a6f802512ca01c0900c79bee3990d0dec4575617999c4b8eb9449d00bf7.exe"C:\Users\Admin\AppData\Local\Temp\a4f43a6f802512ca01c0900c79bee3990d0dec4575617999c4b8eb9449d00bf7.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\_dotnet.exe"_dotnet.exe"2⤵
- Executes dropped EXE
PID:5564
-
-
C:\Windows\SysWOW64\Zombie.exe"C:\Windows\system32\Zombie.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4228
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-189034102-168398478-1159367937-1000\desktop.ini.tmp
- Size 68KB
- SHA256 823fa3f1b34209e63c6a083ae2b509e08b92dd6a52e472dc9600baad01d0308d
- MD5 b6029c82b85c78c0a7c1e3198312e898
- SHA1 9352dc36390505daa68fc6fc7537b9b14bfa2b86
- SHA512 4dcc1dada52c2228d66b019897ff41522ffb2adc6d9ce154c4db630e9760d0cb79171afa2c7d132a08f4081d4e9348c76096f2b0cb17b64789c0a4ef69324a40
- SSDEEP 1536:tApApBHBaBdNhnmNhngDsV5orfxDZ5orfxDHP:+WpBoIT5orfxDZ5orfxDHP
- TLSH T1DF63173DB7D7B453E38A75B5E24370D0916038A37EF839B400D135B21E2BE7A499AD1A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_dotnet.exe
- Size 133KB
- SHA256 a8cd8b9bd4e4b99c7d6e509d1b4fefae7bc15c1e42a218e09ddfd4a924b3da9f
- MD5 bd2e0226c5d444555a233930906e5779
- SHA1 ed7b36f8a6802008bba17b70c7c6beb873ca68b6
- SHA512 d2cdb8f7a384bdb8cfb82e67da27d05ba30206542bf54d815b71b8ba1ef43ebd8cdef3ed7a2debeccd397aeeb7196b29af966d7ea9cbb41acadaafb854e00971
- SSDEEP 3072:TWTSIoXkZA/gwjHnrhtVufJO05m4uvHwog8yT5FoJ:TWTSIoXNHnr1GJOl4uvjgddFu
- TLSH T19DD35A1772AD01ECD2ABE27CC5A29A06F7767866473597CF0390862B0F677E09E39311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\Zombie.exe
- Size 68KB
- SHA256 c60bb43803b86b0401e14bef504795e42f4e13ede32d039f07098e058f8a9616
- MD5 edfb4bf393232481220c6732b71b21d7
- SHA1 9a69bfcf0fad48e5ca637721c00f548e6ed6d889
- SHA512 c238f65bdff56e391dffaf4db90d4ffeb3ccea41b6993323f73b2ff3ad488bc00b563a6534fa01c8aaf73ad6ba0413d7dce6e4edb1c634cd479bc58d92b53a25
- SSDEEP 1536:tApApBHBaBdNhnmNhngDsV5orfxDZ5orfxDHD:+WpBoIT5orfxDZ5orfxDHD
- TLSH T1E663273DB7D7B453E38A75B5E24334D0916038A37EF839B400D135B21E2BE7A499AD1A
- MD5 SHA1 SHA512 SSDEEP TLSH