Analysis
- max time kernel
148s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/07/2026, 05:15
Behavioral task
behavioral1
Sample
2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe
- Size 292KB
- Sample260710-fxqtfadv3n
- SHA256 90d92b3c0e8bc15189a5d8c0f67fdc02d290a3e81ba86fe880de34ed3d5f9238
- MD5 89689aec8018896b7e31e9a78566d0a8
- SHA1 25d21077eaa96b2caf90d1031edd001cb9ab0904
- SHA512 b494855f0f6ecff08c5e42fbb7308031f8cbe87403f5e5d557a97662725692385f9693e5a46fcdd4e7cb4e8cd56e98144c91dd37f767ce80f939543eb61b39b0
- SSDEEP 6144:uFlKgzelZNQSBQGH/CSpWqTSoAXjiU4bzd:JfBQGH6SfOoAX+U4t
- TLSH T15154F2453D53D873E041493189E6CAE14B7F6C1376A2E21BFB981F4B1EF13885AAA271
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Cosmu payload 5 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000d00000001c61f-6.dat family_cosmu behavioral2/files/0x000d00000001c629-81.dat family_cosmu behavioral2/files/0x000c00000001c62e-166.dat family_cosmu behavioral2/files/0x000600000001898a-192.dat family_cosmu behavioral2/files/0x0004000000019b78-206.dat family_cosmu - Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\N: 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\O: 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\D: 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\H: 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\I: 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\M: 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\G: 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\J: 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\K: 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\dotnet.exe 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX9E8A.tmp 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX9F55.tmp 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ExtExport.cab 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.cab 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX9F98.tmp 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX9E79.tmp 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\RCXA060.tmp 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\readme.1xt 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.cab 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.cab 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCXA083.tmp 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX9EE0.tmp 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.cab 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX9BF9.tmp 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX9C2F.tmp 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX9C2E.tmp 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCX9CCD.tmp 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.cab 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\crashreporter.cab 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.cab 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX9F76.tmp 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ielowutil.exe 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.cab 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.cab 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCXA094.tmp 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX9F22.tmp 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX9F96.tmp 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCX9D6D.tmp 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome.cab 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX9FFA.tmp 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCXA071.tmp 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7z.cab 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.cab 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX9E9B.tmp 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX9EDE.tmp 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-10_89689aec8018896b7e31e9a78566d0a8_elex_rhadamanthys_smoke-loader.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2796
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 328KB
- SHA256 7b7c1b1f0dc1e41d691cd84839fb3e935119b3c3cee91ed9bbf96bda8ac3de2b
- MD5 c460588e007dcc459e9fbf1c09ff69e8
- SHA1 6baef5966b63036cc53accaaefee4afdb5a98cdb
- SHA512 77d0f7db4088c421f8054ff944b0e034cad39c92e40d56f6d1e6fda5947b7ececc98e5770a6322420c5516f45725ef8cd060044060c43738a86b7da45da23891
- SSDEEP 6144:SFlKgzelZNQSBQGH/CSpWqTyoAXjiU4bz:1fBQGH6SfeoAX+U4
- TLSH T10A64F1457D93C4B3E0414D31C9E68AE14B7E6C037AA6E11BFF5D0B4B1EB13884BA66B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 1.5MB
- SHA256 07cb7b4a609e89406ff66aaa671491c3f8dace16a92985bca5c48f7821259f68
- MD5 f0003b803f4a79d1d81673742faead36
- SHA1 dd64ccfce6222f8fa13863bbc68959fb66a436df
- SHA512 e1975a0c9e5c5162a6c8c9c8d25be764f394f4eea868bcdf0a6cdc877f900c8198f744a024a6db2181aed28f82ed1e9739cb4512dbd493cc018b8356b595d6eb
- SSDEEP 6144:qFlKgzelZNQSBQGH/CSpWqTZoAXjiU4bz:tfBQGH6Sf9oAX+U4
- TLSH T19D6502457DA3C4B3D0414D3188E68BE19B7F6C137AA6E11BFB9D0B4B1EB13844B6A361
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\RCX9E9B.tmp
- Size 284KB
- SHA256 d3253643bfe1931896665d231dfc850a4e02b3a38334326993ef3dfb06d8c0b1
- MD5 936835cab6ccab014a4e80cc10e3b050
- SHA1 9f1597efa199e7a5d8dc71d68c4fbf04c1743142
- SHA512 e5113423964434e17c354731a0f9d04f6d980dae885cbe195dfade58300926a3fadc8fff7fc1380e7e7cc15025057e65e9225b5bb688aca751ecee09f546f9d0
- SSDEEP 6144:uFlKgzelZNQSBQGH/CSpWqTRoAXjiU4bz:JfBQGH6SfdoAX+U4
- TLSH T1B854F1457D93C4B3D0414D31C9E68BE14B7E6C037AA6E11BFB5D0B4B1EB13884BAA6B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\RCXA00D.tmp
- Size 284KB
- SHA256 59e5fe85d3605cc6788e47efd234ab4a6d63780809e822e62f40daaab470c622
- MD5 1e30eb5a6d3011dd82755d33240f25e2
- SHA1 ec3a27916b5be439264ec6757f3995afc93c0a59
- SHA512 e002fd51f88f58fc9b985b7756ac2bb499f4370bbe001a9bdd99724dcf2288b16385ee7c9b00778277a6051a95cc02bfb96f09931e7f675822a5c1b7d0e96eff
- SSDEEP 6144:yFlKgzelZNQSBQGH/CSpWqTEoAXjiU4bz:VfBQGH6SfwoAX+U4
- TLSH T1E65402457D93C4B3D0414D3188E68BE18B7F6C137AA6E11BFB5D0B4B1EB13844BAA261
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\jabswitch.exe
- Size 284KB
- SHA256 806e12cca0acc623491f62322d68ba7e055be432269d882852eb370d84c8390d
- MD5 5ed3a18ec79d5c26451f45d3e9403316
- SHA1 30c8f7c381d833632402af84c736681caed5f102
- SHA512 29886ea46836e78c03321257478d2ef208251dcfb43e2638422545622df81d9ba8e70ce780d0096597819140247d40a418a6022032563c2fd1310f8c121d3edd
- SSDEEP 6144:yFlKgzelZNQSBQGH/CSpWqTloAXjiU4bzt:VfBQGH6Sf5oAX+U4d
- TLSH T1BA5402457D93C4B3D0414D3188E68BE19B7F6C137AA6E11BFB9D0B4B1EB13844BAA361
- MD5 SHA1 SHA512 SSDEEP TLSH