Analysis
- max time kernel
148s - max time network
122s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260630-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/07/2026, 17:02
Behavioral task
behavioral1
Sample
2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe
- Size 284KB
- Sample260702-vkeyqsfv6l
- SHA256 c06a556d153928b86d73133c5c44baa92496d4e4bddbe105cede53e04bd83eab
- MD5 97df7bf0d879ac276e147f5fc27f48c6
- SHA1 73b25205a6c006b1b38eee62c547bdff703397ec
- SHA512 9ea6a256de37ad61fd978bcf5b585404db710ff3c10d411a96e97bfe1363a909f69c936b2c2499a6272ee17e3ecba458a62a680a127f29a64c49e0d69f99e2a0
- SSDEEP 6144:MFlKgzelZNQSBQGH/CSpWqT6oAXjiU4bzF:LfBQGH6SfOoAX+U41
- TLSH T1B25402457D93C4B3D0414D3188E68BE19B7F6C137AA6E11BFB9D0B4B1FB13844BAA261
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Cosmu payload 3 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000f00000001c5c1-6.dat family_cosmu behavioral2/files/0x000d00000001c5db-81.dat family_cosmu behavioral2/files/0x0006000000018973-192.dat family_cosmu - Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\I: 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\J: 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\L: 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\M: 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\N: 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\O: 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\G: 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\H: 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\K: 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.cab 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.cab 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX916.tmp 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX614.tmp 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX749.tmp 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX85F.tmp 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.cab 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCX67B.tmp 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX76D.tmp 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX7FA.tmp 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ielowutil.cab 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.cab 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.cab 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX82D.tmp 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX658.tmp 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7z.cab 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX780.tmp 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX7D9.tmp 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iexplore.cab 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX646.tmp 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.cab 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX85E.tmp 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX603.tmp 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX635.tmp 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\dotnet.cab 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX8A1.tmp 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX76B.tmp 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.cab 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iexplore.exe 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\crashreporter.cab 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.cab 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.cab 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX602.tmp 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX77E.tmp 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX793.tmp 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX75A.tmp 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX792.tmp 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX86F.tmp 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX76C.tmp 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.cab 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX7FC.tmp 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ExtExport.exe 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.cab 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\readme.1xt 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-02_97df7bf0d879ac276e147f5fc27f48c6_elex_rhadamanthys_smoke-loader.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3676
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 322KB
- SHA256 23ac23a1955be20aad3412f1f219ee98ba24ceb77d913b3093fb032f2749a4e2
- MD5 fb082d5e7d4ab4304bd146455c438310
- SHA1 e0d4a8e629afc31d4c7b88275a4e210983c241cb
- SHA512 3dbf8ee2dd32b82c1058ff5b427e6b05881e3b7ccbd63060a885286a2f6787d10c2c0b1a15e3da8954c8a39f5fe2830d4223c1d517b2c55ddee3b54095de720d
- SSDEEP 6144:5FlKgzelZNQSBQGH/CSpWqTyoAXjiU4bz:OfBQGH6SfeoAX+U4
- TLSH T13464F1457D93C4B3E0414D31C9E68AE14B7E6C037AA6E11BFF5D0B4B1EB13884BA66B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\RCX76C.tmp
- Size 284KB
- SHA256 0f655437d676fd0f44b3b7dd08699e35b8d6435dbccd231bbbf16f92bb5b6328
- MD5 4f5e55d982135883d90053af363fbe65
- SHA1 5434b42f50772a0542126c3fa8db69d9bc98c5c0
- SHA512 60fa8494eb8c4ff9d1a8d0ba0818c9eca454e3dc3401ac01e13a9559d698303cf651a47bbb91214f7e7ffba7cddfe39d0b649c6613341c0146bc810d22a8d312
- SSDEEP 6144:lFlKgzelZNQSBQGH/CSpWqTRoAXjiU4bz:ifBQGH6SfdoAX+U4
- TLSH T10854F1457D93C4B3D0414D31C9E68BE14B7E6C037AA6E11BFB5D0B4B1EB13884BAA6B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\RCX870.tmp
- Size 284KB
- SHA256 a19d3e6682ffae512ff910d74315e56a2bd64c53c05af0fe422d8b8b713ef76f
- MD5 3f5fa8a54a614c6bd40e4013bd7bf542
- SHA1 01a99a8fb6f2d779edeb3a68890109a6dfc213e7
- SHA512 5a7e0ab2b744d5ddf6a46180f4c3d7e4ccb402e14ef8f32c9d82e2a1165ca9815b32a70c5d6a84fddd7eb7c37b7a11ee6a7ce0d5f0fa6e883ea681477dac97f1
- SSDEEP 6144:xFlKgzelZNQSBQGH/CSpWqTEoAXjiU4bz:mfBQGH6SfwoAX+U4
- TLSH T1905402457D93C4B3D0414D3188E68BE19B7F6C137AA6E11BFB5D0B4B1EB13844BAA261
- MD5 SHA1 SHA512 SSDEEP TLSH