Analysis
- max time kernel
148s - max time network
122s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/07/2026, 16:05
Behavioral task
behavioral1
Sample
2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe
- Size 284KB
- Sample260705-tjwdnadx21
- SHA256 509a9ab2c3e635cc75556dba5a5877996c1e2ad1d621d49a7d2a477d36d78bc1
- MD5 72f1fc11293609151824467232e6194b
- SHA1 8f77936581bddf3c0ccb0e5cdb90f9f169eaff97
- SHA512 f71cc7064a60e16354a5e03244950928eff37552d863760c639e012901643ca2a61ee2e87ec43e1cb2a74bc1eb7414d0eeb0b9aae6ff8e737e09d8a00b10f0f5
- SSDEEP 6144:UFlKgzelZNQSBQGH/CSpWqTaoAXjiU4bzF:TfBQGH6SfuoAX+U41
- TLSH T18B5402457D93C4B3D0414D3188E68BE19B7F6C137AA6E11BFB9D0B4B1FB13844BAA261
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Cosmu payload 3 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000d00000001c676-6.dat family_cosmu behavioral2/files/0x000400000001bb42-81.dat family_cosmu behavioral2/files/0x000500000001888b-192.dat family_cosmu - Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\I: 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\J: 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\K: 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\O: 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\G: 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\H: 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\L: 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\M: 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\N: 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Internet Explorer\ieinstal.cab 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX832F.tmp 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX8171.tmp 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX813C.tmp 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX815F.tmp 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX8218.tmp 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.cab 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ieinstal.exe 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iexplore.cab 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.cab 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX82AC.tmp 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ielowutil.exe 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX8385.tmp 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX802B.tmp 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome.cab 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.cab 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\dotnet.cab 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ielowutil.cab 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iexplore.exe 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX81A3.tmp 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX8219.tmp 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\dotnet.exe 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.cab 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX8342.tmp 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.cab 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX826A.tmp 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX814E.tmp 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\dotnet.cab 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX8364.tmp 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCX808F.tmp 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX82EE.tmp 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCX83A8.tmp 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\readme.1xt 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX826B.tmp 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.cab 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX7FC9.tmp 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX7FC7.tmp 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCX805E.tmp 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX8161.tmp 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.cab 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.cab 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX82AD.tmp 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-05_72f1fc11293609151824467232e6194b_elex_rhadamanthys_smoke-loader.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3456
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 323KB
- SHA256 a51bfefdc3ac6f22e351f05f576de11544e28ef01bdceb3316b103963309f62a
- MD5 2a4e3826c17a2b6c4cd7d0e8fe450bd2
- SHA1 f7c3b48641e2d8ab03d413c338836941066804f1
- SHA512 c6992e861aaf4c25f3bc057af98169122aa5814e422c9755f1c0101f303ef336cfca00c6196f1f0e34579660d5edde83e68d67473df3cd08754fcf21042b8d42
- SSDEEP 6144:DFlKgzelZNQSBQGH/CSpWqTyoAXjiU4bz:MfBQGH6SfeoAX+U4
- TLSH T11E64F1457D93C4B3E0414D31C9E68AE14B7E6C037AA6E11BFF5D0B4B1EB13884BA66B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\RCX815F.tmp
- Size 284KB
- SHA256 e875d26da984f1f7ad4a7f2cfb760aabc7f928b4814e9e68878028c29c8ceefe
- MD5 a0be7f340618f2149cc54b4be7da2329
- SHA1 5bc28552fd281e9607184ec94fbbe7cdc5b43bc9
- SHA512 74c0443475f8d8c64188d5c5f05e99ba6737db8106abf16958fe3834103eb990019c9d329d0dc6efdb1873f02e29381cccb8dcfaa9700292e3ca801cac049d87
- SSDEEP 6144:fFlKgzelZNQSBQGH/CSpWqTRoAXjiU4bz:QfBQGH6SfdoAX+U4
- TLSH T17154F1457D93C4B3D0414D31C9E68BE14B7E6C037AA6E11BFB5D0B4B1EB13884BAA6B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\RCX830F.tmp
- Size 284KB
- SHA256 620b16c701c84fdbdba6aff006769ac96f01e3f0c8195f8adbba28df0b0777a8
- MD5 2dd7f3c165318c0da4ec7ddce36e2d27
- SHA1 579c4f481cede58aa96525a99b9e3eacb2fea58f
- SHA512 fc648f9720e74b370154a84ff29ce8f69078ac759977be98c1f9c9f1e7db2e268f91af3b03087ba48aaf5e4312de5cb2d252abdf996a335859c7604178fc4c05
- SSDEEP 6144:zFlKgzelZNQSBQGH/CSpWqTEoAXjiU4bz:cfBQGH6SfwoAX+U4
- TLSH T13D5402457D93C4B3D0414D3188E68BE19B7F6C137AA6E11BFB5D0B4B1EB13844BAA271
- MD5 SHA1 SHA512 SSDEEP TLSH