Analysis
- max time kernel
148s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/07/2026, 22:53
Behavioral task
behavioral1
Sample
2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe
- Size 1.5MB
- Sample260706-2t5dbaat2l
- SHA256 40768d358081b6f8602781a61cd1f673ca793dada0d8ec030124910cc07c47f1
- MD5 0198606f7464562771170eb8fc12010b
- SHA1 431968c5481b6ece8c1ab608a8f59b816b2affd3
- SHA512 195bfbcd5818c4f70455e121c371b6d73683b759d0e9998bf36353bfca9db196b191adc207d88b96dc108d25cea08320ec20fa0775197102e7f48d39de156987
- SSDEEP 6144:sFlKgzelZNQSBQGH/CSpWqTeoAXjiU4bz:rfBQGH6SfioAX+U4
- TLSH T11A6502457DA3D4B3D0414D3188E68BE18B7F6C137AA6E117FB9D0B4B1EB13844BAA361
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Cosmu payload 3 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000d00000001c5b2-7.dat family_cosmu behavioral2/files/0x000c00000001c5bd-82.dat family_cosmu behavioral2/files/0x000700000001898d-193.dat family_cosmu - Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\G: 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\H: 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\I: 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\L: 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\O: 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\D: 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\J: 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\K: 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\M: 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe - Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000\Control Panel\Desktop\Wallpaper = "C:\\windows\\WallPapers.jpg" 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.cab 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.cab 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX3FB6.tmp 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.cab 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ieinstal.cab 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.cab 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCX4287.tmp 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7zFM.cab 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.cab 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX420F.tmp 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX4241.tmp 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX3F72.tmp 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome.cab 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX4122.tmp 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.cab 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.cab 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX40EC.tmp 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX4146.tmp 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.cab 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.cab 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ielowutil.cab 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX4231.tmp 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.cab 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7z.cab 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX40D9.tmp 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX40DA.tmp 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX41AB.tmp 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX41BC.tmp 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.cab 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iexplore.cab 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.cab 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.cab 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ieinstal.exe 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.cab 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ielowutil.exe 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\readme.1xt 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX3F41.tmp 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX3FC7.tmp 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX4145.tmp 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\RCX4252.tmp 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.cab 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCX400B.tmp 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.cab 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\windows\WallPapers.jpg 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe File created C:\windows\readme.1xt 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000\Software\Microsoft\Internet Explorer\Desktop\General 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe Set value (str) \REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000\Software\Microsoft\Internet Explorer\Desktop\General\WallpaperSource = "C:\\windows\\WallPapers.jpg" 2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-06_0198606f7464562771170eb8fc12010b_elex_rhadamanthys_smoke-loader.exe"1⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:3772
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 325KB
- SHA256 648d3af349e1a7423fa7cfd5a323fb88f51841185667ceac3d7927766d84db62
- MD5 4082908073815f85b5256c5543ca9de6
- SHA1 bb4d6e4bb7255fc8ee5f3a3d4d6fac4840f85824
- SHA512 5e1099c9ff9897e366987ed05a77d2185a2eb8de10de1a8d702d3ca8fff362d9be287b313683964e3297202171ef16ebb9ceda817f656a9544d7bfff509926e3
- SSDEEP 6144:cFlKgzelZNQSBQGH/CSpWqTyoAXjiU4bz:7fBQGH6SfeoAX+U4
- TLSH T1D964F1457D93C4B3E0414D31C9E68AE14B7E6C037AA6E11BFF5D0B4B1EB13884BA66B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\RCX40DB.tmp
- Size 284KB
- SHA256 c0a929138dcabc5445611ed53f6137d7e76c388d0e28f9d6b7a29cd54b36ac7b
- MD5 1f213c388274f933d610b1a53e4e9bf6
- SHA1 bb335e6ba9a8b33490daa68dc38d7b3ad640b63b
- SHA512 f1ccf9b2fe158742cfc9beda32d27a40da3d416d47951ba58c1a49895b8ae89f4b573c32471404a57ac1323f6472c88c6d9dd5efc504b16ca93c386b9d196f5b
- SSDEEP 6144:IFlKgzelZNQSBQGH/CSpWqTRoAXjiU4bz:/fBQGH6SfdoAX+U4
- TLSH T10554F1457D93C4B3D0414D3189E68BE14B7E6C037AA6E11BFB5D0B4B1EB13884BAA6B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\RCX41FF.tmp
- Size 284KB
- SHA256 51d1cbd613c8070a6e12bd5da32df73200c8b8908f83efc4f38e8baba4f4198c
- MD5 7ed1fbb32d0b80fc41e84e8aadf7c0ac
- SHA1 a786201bba2f82a138eb4cfc7af19c55ac75b1f3
- SHA512 166580ce376df9a309ef327673f3cf14d64b2c00dba3d1565b3e4ee554ad01f87cfd086f69078c97a50df3778fb8ef6d56b4243bdea491874c3c281fdad3fac1
- SSDEEP 6144:0FlKgzelZNQSBQGH/CSpWqTEoAXjiU4bz:zfBQGH6SfwoAX+U4
- TLSH T1235402457D93C4B3D0414D3188E68BE19B7F6C137AA6E11BFB5D0B4B1EB13844BAA271
- MD5 SHA1 SHA512 SSDEEP TLSH