Overview

overview

10

Static

static

10

2026-07-20...er.exe

windows10-2004-x64

10

2026-07-20...er.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    130s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    20/07/2026, 09:27

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-20_8410579718e67b9007b5e95ecd740895_elex_rhadamanthys_smoke-loader.exe
  • Size 288KB
  • Sample260720-levbssfx6z
  • SHA256 04f9dd31507a5b36169f7c5fdf79bca124e5763d3f3aeb48243b570e08725db8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
discoverycosmuworm

Malware Config

Signatures

  • Family: Cosmu

    Cosmu is a Windows worm written in C++.

    wormcosmu
  • Detects Cosmu payload 5 IoCs

    Cosmu is a worm written in C++.

  • Enumerates connected drives 3 TTPs 10 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-20_8410579718e67b9007b5e95ecd740895_elex_rhadamanthys_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-20_8410579718e67b9007b5e95ecd740895_elex_rhadamanthys_smoke-loader.exe"
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:8

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.cab
        • Path C:\Program Files\7-Zip\7z.cab
        • Size 549KB
        • SHA256 707f415d7d581edd9bce99a0429ad4629d3be0316c329e8b9ebd576f7ab50b71
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 334KB
        • SHA256 f9bd4723f8e1d2a7164a2835a3e0a64556f5dcc8b04c75e19f19d41aa4b2fd02
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.cab
        • Path C:\Program Files\7-Zip\7zFM.cab
        • Size 963KB
        • SHA256 028cf2158df45889e9a565c9ce3c6648fb05c286b97f39c33317163e35d6f6be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.cab
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab
        • Size 281KB
        • SHA256 6d54694077faf07473196da7b7f1c6981c8ad6a462fcea4777a80cfc6bc5769e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RCX4855.tmp
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX4855.tmp
        • Size 288KB
        • SHA256 ea844c5e972cc05adf79ebcc201d53ba7cc86b7662ff5cc8570e3c82f39d9531
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.cab
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab
        • Size 2.1MB
        • SHA256 7e0976036431640ae1d9f1c0b52bcea5dd37ef86cd3f5304dc8a96459d9483cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.cab
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.cab
        • Size 6.1MB
        • SHA256 ca434df4bbfcadf6a6610a6bbea4eb435adb91751670f63c0a6bc3207e4a89a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.cab
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab
        • Size 1.7MB
        • SHA256 415ddfcaeb5f4240359dd12ed5cc53610c27d144ce44df6013ea5f6546102080
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.cab
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.cab
        • Size 3.5MB
        • SHA256 e0004b24f9d4e74eff4e221871e5bb7233b57033f5725c5d5c67c07f0a8976ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RCX49F8.tmp
        • Path C:\Program Files\Google\Chrome\Application\RCX49F8.tmp
        • Size 344KB
        • SHA256 f18c62b0f8c54c51adb762b96302b23e706124e6d38ad175952dafd16c76ea0e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.cab
        • Path C:\Program Files\Google\Chrome\Application\chrome.cab
        • Size 3.1MB
        • SHA256 fdcfa390134b6d9a6bb68f9b7c452c01701e2b27fca1b9227e5b92f652df2457
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 1.5MB
        • SHA256 3ff09bad4e08deef867049e3139f07298d366b615cc9b5384b91540074ba669e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.cab
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.cab
        • Size 1.4MB
        • SHA256 79587605707bb61fde6eb92ee778b2e2a01725daac73e07f1569f9de4368f72b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 334KB
        • SHA256 b066d0180165555270a5de55eb33b4b220e5be163f0d7db0f579ec72af0d97cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.cab
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab
        • Size 23KB
        • SHA256 ea8543b0eab31dece2b50ef45a2585f4de09af35c68d9a63152944f8a831ac29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.cab
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.cab
        • Size 23KB
        • SHA256 955f386e3af5d87a46dcb2064967e34eb25a44ca3d2436e54bd5b84f4a2ab2ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.cab
        • Path C:\Program Files\Java\jre-1.8\bin\jabswitch.cab
        • Size 44KB
        • SHA256 7f1b10f0679401e5360f7e0baf903035728a631c03056b7d40dbb6ae734fecae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.cab
        • Path C:\Program Files\Java\jre-1.8\bin\java-rmi.cab
        • Size 23KB
        • SHA256 ee8ecfd717dfde63ff423f21fca560d80ec333ebfe2d55aba23fb7a1c4bffaaf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OSPPREARM.cab
        • Path C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab
        • Size 238KB
        • SHA256 ac66bafa0e7196b9f7b4a83b9625b32e83db7731418ecd0f4a8de474f7355254
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        crashreporter.cab
        • Path C:\Program Files\Mozilla Firefox\crashreporter.cab
        • Size 3.4MB
        • SHA256 180179d0b6cd38c05a5c6b42789517d8ff5e53123cef96004e27a476a069266b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        default-browser-agent.cab
        • Path C:\Program Files\Mozilla Firefox\default-browser-agent.cab
        • Size 34KB
        • SHA256 685f420616cb6ec8720f194bb9fdb45c79973f1976f2b3288f1efbf7b0fd0fde
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        helper.cab
        • Path C:\Program Files\Mozilla Firefox\uninstall\helper.cab
        • Size 1.3MB
        • SHA256 adeb96785772bef583c62e7796393cdb33489638dacce17b320704fb1844713d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.cab
        • Path C:\Program Files\dotnet\dotnet.cab
        • Size 143KB
        • SHA256 7ae20d0542a544b54730a5520a2c7b56dc9235be1a4dc1331763786a16fabed9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.cab
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab
        • Size 56KB
        • SHA256 6e25f414dd65440cd0c285990f4eef789a831fff640dadb4afdf79a5dfd95bc2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download