Analysis
- max time kernel
148s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/07/2026, 06:54
Behavioral task
behavioral1
Sample
2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe
- Size 1.4MB
- Sample260718-hph5qsbt6m
- SHA256 1895edd3ecbf55d9c4757c9186d412f45ddc9fc4ed8adc3c0cc3933000c6f031
- MD5 9ed7775ea0ec1d94dcf8048e3c70cb5d
- SHA1 4af0c9ba5c1ce5d9460fe8b89e5b2bcb610f9c06
- SHA512 5e4b45e4a61865ab340af44018d56b9af62c213fdbd705bcd5eb10cdea6d4f768bcbd21d083bcb53fdfe1cb468b2eb8d20b9cef0d3b181ad77ceb2a70a1d790c
- SSDEEP 24576:Ufa86SfLkQ5W9GIpThCTZ0og6f5MLb+VONw/haSqnFGUMhglHZaawTXaV:UfaygL9fpTgTZ0og6fWLb+VOa/hunKhY
- TLSH T16C65CFC2F202D0A5DC1645308C27DFF81B16BE62AD1116177BD8BF5FAEB3382592259B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000300000001b32b-8.dat family_cosmu behavioral2/files/0x000d00000001c52e-9.dat family_cosmu behavioral2/files/0x000c00000001c536-81.dat family_cosmu behavioral2/files/0x00070000000189a1-192.dat family_cosmu - Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\H: 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\J: 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\L: 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\N: 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\G: 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\I: 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\K: 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\M: 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\O: 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX10E6.tmp 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX1267.tmp 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.cab 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX11FB.tmp 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.cab 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCX157A.tmp 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX1090.tmp 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX10B5.tmp 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\dotnet.exe 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.cab 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX1211.tmp 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iediagcmd.cab 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ielowutil.exe 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.cab 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX1244.tmp 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX1289.tmp 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX1569.tmp 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX120F.tmp 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\dotnet.cab 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX1568.tmp 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.cab 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.cab 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ielowutil.cab 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.cab 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX1505.tmp 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.cab 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCX112A.tmp 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX12CD.tmp 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX14E4.tmp 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX10A1.tmp 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX10D6.tmp 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX11EA.tmp 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX12BB.tmp 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ieinstal.cab 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX11E7.tmp 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX1222.tmp 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.cab 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX14F4.tmp 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX1535.tmp 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.cab 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\dotnet.cab 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.cab 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCX158B.tmp 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-18_9ed7775ea0ec1d94dcf8048e3c70cb5d_elex_rhadamanthys_smoke-loader.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4708
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 326KB
- SHA256 c5639c6e9761288061d21c37ade09602eb2c2da34db36658301ca14d1bb86a9d
- MD5 d18140f13c22205be85ec91ef937716c
- SHA1 1767be0cae452bb29bef4a8aaa63944283b53734
- SHA512 48d067d0b16c15a9c3851b923295bfac4b068c9a5e4b0d998d918ffc981e1a215a1786482a2abe6750f1c83af1f232f1f8bf242795413459b079fc0e06c1c538
- SSDEEP 6144:2FlKgzelZNQSBQGH/CSpWqTEoAXjiU4bz:xfBQGH6SfQoAX+U4
- TLSH T1A36402457D93C4B3D0414D3188E68BE14B7F6C137AA6E11BFB9D0B4B1EB13884BA6271
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\RCX10A2.tmp
- Size 326KB
- SHA256 a146bf9abf78eada76d60d83a38589501d46d460441b8962ba136bf027421f9f
- MD5 db38a921e91b3e1b209b082a2f5c6301
- SHA1 ae0c62031e16eb9d5fc1d485c49447a8ca2a2bac
- SHA512 fba1b9ae5c332f7dfe1bf54965a0a95e1986cab7fd610dd0f9cd7f1447c62d7f6d93be845f2e1797a892db9873d04a2fa68fca3df7af83b91b743486279e6cad
- SSDEEP 6144:mFlKgzelZNQSBQGH/CSpWqTyoAXjiU4bz:BfBQGH6SfeoAX+U4
- TLSH T19C64F1457D93C4B3E0414D31C9E68AE14B7E6C037AA6E11BFF5D0B4B1EB13884BA66B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\RCX11FB.tmp
- Size 284KB
- SHA256 029ef002171ad9a1b506fe1616b76913a81363d6ef19c890aa439c9e7a591d54
- MD5 da2fea87962b17617649b851d3293470
- SHA1 90332522e9eda6a1e690d6c5564d876f5b373078
- SHA512 13209d33773559dcf250c1ec79e0a484de345645590fb8c6abf2f90e0a63597b8b29175d9eb718283d7b14dec7a955c7d056e39cc9977ef7d7ee67518a6f15b1
- SSDEEP 6144:iFlKgzelZNQSBQGH/CSpWqTRoAXjiU4bz:lfBQGH6SfdoAX+U4
- TLSH T18154F1457D93C4B3D0414D31C9E68BE14B7E6C037AA6E11BFB5D0B4B1EB13884BAA6B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\RCX14E4.tmp
- Size 284KB
- SHA256 7b86014c330987cc5c40ebea04ad8ebd124bddd82431448b44460236c4c182e5
- MD5 10bda31f2ff50f7d7ea8186f594de33e
- SHA1 f0091fdf7046bb0dc38bd12902e62bcd23821d1e
- SHA512 38e42490e9250b38a0ab556c2dbf55166c5b4a89cd3a74a31864b7572e1b1555d2d2a91e698ba3b0acfab7e5bdfebf07207af213b079012883e1f8fb86633d15
- SSDEEP 6144:mFlKgzelZNQSBQGH/CSpWqTEoAXjiU4bz:BfBQGH6SfwoAX+U4
- TLSH T1975402457D93C4B3D0414D3188E68BE19B7F6C137AA6E11BFB5D0B4B1EB13844BAA271
- MD5 SHA1 SHA512 SSDEEP TLSH