Overview

overview

10

Static

static

10

2026-06-04...op.exe

windows10-2004-x64

10

2026-06-04...op.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    96s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    04/06/2026, 20:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-04_ff8e211f67ea5bdc1a264fff2b6da9f9_elex_rhadamanthys_stop.exe
  • Size 224KB
  • Sample260604-yx4dmsdy3x
  • SHA256 153ff8abdce27c8b89d1768ca8d4356d61ac4aba97dd9d2c17dc891abca33310
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
discoverycosmuworm

Malware Config

Signatures

  • Family: Cosmu

    Cosmu is a Windows worm written in C++.

    wormcosmu
  • Detects Cosmu payload 16 IoCs

    Cosmu is a worm written in C++.

  • Enumerates connected drives 3 TTPs 10 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-04_ff8e211f67ea5bdc1a264fff2b6da9f9_elex_rhadamanthys_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-04_ff8e211f67ea5bdc1a264fff2b6da9f9_elex_rhadamanthys_stop.exe"
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:1680

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.cab
        • Path C:\Program Files\7-Zip\7z.cab
        • Size 549KB
        • SHA256 707f415d7d581edd9bce99a0429ad4629d3be0316c329e8b9ebd576f7ab50b71
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 263KB
        • SHA256 aba593b8a07eb01141359d90711be76fd08d011a31ebd084c197f17617abdd98
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.cab
        • Path C:\Program Files\7-Zip\7zFM.cab
        • Size 963KB
        • SHA256 028cf2158df45889e9a565c9ce3c6648fb05c286b97f39c33317163e35d6f6be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 263KB
        • SHA256 187159dfc698edcf347ce9b43282b37bed18a3884f743fd00695358e265c0604
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RCX2E22.tmp
        • Path C:\Program Files\7-Zip\RCX2E22.tmp
        • Size 224KB
        • SHA256 4ff7183380628395a031c5575e4f489df6cb42a4e193bb11c41f90927e678ac5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.cab
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab
        • Size 281KB
        • SHA256 6d54694077faf07473196da7b7f1c6981c8ad6a462fcea4777a80cfc6bc5769e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.cab
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab
        • Size 2.1MB
        • SHA256 7e0976036431640ae1d9f1c0b52bcea5dd37ef86cd3f5304dc8a96459d9483cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 1.5MB
        • SHA256 d874b6c8b402baecff679d7a2875f77d80ed4bd98b0a09a8f47e6c8020a81dcf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.cab
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.cab
        • Size 6.1MB
        • SHA256 ca434df4bbfcadf6a6610a6bbea4eb435adb91751670f63c0a6bc3207e4a89a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 1.5MB
        • SHA256 01fbeb5729d6596c884784697b1ac438e3227b2f051a77cad6821db0ab902656
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 1.5MB
        • SHA256 3bd51934e0bbe95e7f4221cae16da378487a695a7c8ba662023355a836d6d9af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.cab
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab
        • Size 1.7MB
        • SHA256 415ddfcaeb5f4240359dd12ed5cc53610c27d144ce44df6013ea5f6546102080
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 1.5MB
        • SHA256 a417debe1d042876fb22ba531d0c9e180faa5ab3543a4950bc85dfd7bff071ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.cab
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.cab
        • Size 3.5MB
        • SHA256 e0004b24f9d4e74eff4e221871e5bb7233b57033f5725c5d5c67c07f0a8976ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.cab
        • Path C:\Program Files\Google\Chrome\Application\chrome.cab
        • Size 3.1MB
        • SHA256 fdcfa390134b6d9a6bb68f9b7c452c01701e2b27fca1b9227e5b92f652df2457
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 1.5MB
        • SHA256 b9ae651fb1b25fef8bfdf2be6d59317192a95833f19d9cb55c5f1e2d2c9f805b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.cab
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.cab
        • Size 1.4MB
        • SHA256 79587605707bb61fde6eb92ee778b2e2a01725daac73e07f1569f9de4368f72b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 263KB
        • SHA256 8c783e91df444b13d202c948c5f7eedea95982542978e5732df681c29b84d146
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.cab
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab
        • Size 23KB
        • SHA256 ea8543b0eab31dece2b50ef45a2585f4de09af35c68d9a63152944f8a831ac29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 224KB
        • SHA256 bd7ba99ba9cc67ac8a7f7f546da95ad9934dafd26db8c8c1a3da29ec56fbe654
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.cab
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.cab
        • Size 23KB
        • SHA256 955f386e3af5d87a46dcb2064967e34eb25a44ca3d2436e54bd5b84f4a2ab2ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.cab
        • Path C:\Program Files\Java\jre-1.8\bin\jabswitch.cab
        • Size 44KB
        • SHA256 7f1b10f0679401e5360f7e0baf903035728a631c03056b7d40dbb6ae734fecae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jre-1.8\bin\jabswitch.exe
        • Size 224KB
        • SHA256 597a30e2b0f8a41b047c38db3275df0ee49dc414d7df46deb3e502117e478828
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.cab
        • Path C:\Program Files\Java\jre-1.8\bin\java-rmi.cab
        • Size 23KB
        • SHA256 ee8ecfd717dfde63ff423f21fca560d80ec333ebfe2d55aba23fb7a1c4bffaaf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OSPPREARM.cab
        • Path C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab
        • Size 238KB
        • SHA256 ac66bafa0e7196b9f7b4a83b9625b32e83db7731418ecd0f4a8de474f7355254
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        crashreporter.cab
        • Path C:\Program Files\Mozilla Firefox\crashreporter.cab
        • Size 3.4MB
        • SHA256 180179d0b6cd38c05a5c6b42789517d8ff5e53123cef96004e27a476a069266b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        crashreporter.exe
        • Path C:\Program Files\Mozilla Firefox\crashreporter.exe
        • Size 1.5MB
        • SHA256 e61fb3563a7e3e91bef8e73d825a09f962c1a8da55721d24bb4ee29ff7da3bc9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        default-browser-agent.cab
        • Path C:\Program Files\Mozilla Firefox\default-browser-agent.cab
        • Size 34KB
        • SHA256 685f420616cb6ec8720f194bb9fdb45c79973f1976f2b3288f1efbf7b0fd0fde
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        default-browser-agent.exe
        • Path C:\Program Files\Mozilla Firefox\default-browser-agent.exe
        • Size 224KB
        • SHA256 8c9c8f8bc426e8c3cad444103ee8055d441771229e7520ac0d9db584e921d809
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        helper.cab
        • Path C:\Program Files\Mozilla Firefox\uninstall\helper.cab
        • Size 1.3MB
        • SHA256 adeb96785772bef583c62e7796393cdb33489638dacce17b320704fb1844713d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        helper.exe
        • Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe
        • Size 263KB
        • SHA256 c78b98316c7eda8d49be2fd8b8a519cc69ee52c863ec188b7013ce4aae676432
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.cab
        • Path C:\Program Files\dotnet\dotnet.cab
        • Size 143KB
        • SHA256 7ae20d0542a544b54730a5520a2c7b56dc9235be1a4dc1331763786a16fabed9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 268KB
        • SHA256 fda0ba77942a036438733667ef22a73cbe4a1eefadc8a2f347209ab7ac1b202e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.cab
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab
        • Size 56KB
        • SHA256 6e25f414dd65440cd0c285990f4eef789a831fff640dadb4afdf79a5dfd95bc2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 224KB
        • SHA256 b8e37a8880133c3a8726c0658d0c4eadd416dd68b4aae3a5982ca8159f83ebf8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download