Analysis
- max time kernel
148s - max time network
131s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
21/07/2026, 14:57
Behavioral task
behavioral1
Sample
2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe
- Size 444KB
- Sample260721-sblc2sdl6v
- SHA256 e06a933a32ff7f5a9688dbc8b805fce4e456215c74528765296877806f86795e
- MD5 9c60b8df9a1813a159e3beb88ee68e3b
- SHA1 c4f7ff49e641a739f5c281da70de91a32ad05a39
- SHA512 69f4bba728cdbac06fd2a3bbb79af9958aec8653e7009dc05e449e4915d3e5af58675325cbd71fdeb2c7b5a1eae9c63330c43ca4692f4379c7ee4f3f645475c4
- SSDEEP 6144:qFlKgzelZNQSBQGH/CSpWqTvoAXjiU4bz:tfBQGH6SfboAX+U4
- TLSH T138A4BE5D795F86F2C3059A3D4465CBA1C23AFF02D961B107BBD83B0BEE722C74A25261
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000d00000001c5b9-6.dat family_cosmu behavioral2/files/0x00070000000184cc-76.dat family_cosmu behavioral2/files/0x000c00000001c5c4-81.dat family_cosmu behavioral2/files/0x000500000001898c-192.dat family_cosmu - Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\H: 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\L: 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\M: 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\G: 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\I: 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\J: 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\K: 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\N: 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\O: 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7z.cab 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX9209.tmp 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.cab 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX91B1.tmp 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX922A.tmp 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ieinstal.exe 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7z.exe 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iexplore.cab 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCX93F1.tmp 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX91E5.tmp 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX912A.tmp 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.cab 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX92EB.tmp 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.cab 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX919F.tmp 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX9006.tmp 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX935F.tmp 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.cab 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX915B.tmp 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.cab 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.cab 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCX904C.tmp 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX91C2.tmp 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.cab 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX9229.tmp 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX928B.tmp 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX916E.tmp 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.cab 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX916D.tmp 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX92DB.tmp 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome.cab 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX91F7.tmp 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ielowutil.cab 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.cab 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCX93F3.tmp 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX9007.tmp 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-21_9c60b8df9a1813a159e3beb88ee68e3b_elex_rhadamanthys_smoke-loader.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4972
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 334KB
- SHA256 75f43aa223080801b9b718f23c39b61c739f2f89ab4c63def065f0493a2d7560
- MD5 58d9aaee60cc4bc17a509c6d39304ae0
- SHA1 ee4b0c6f2c88aec5b9099fdf64b477e956210ff6
- SHA512 a2761c1c1791aefd9494ecf68e3e871e164a37515daa2d4f1370818d6607ef0ce293ac282dea18da064ebffa72c406719db40f3b520bb45070ad2a16dcff0a05
- SSDEEP 6144:DFlKgzelZNQSBQGH/CSpWqTyoAXjiU4bz:MfBQGH6SfeoAX+U4
- TLSH T15174F1457D93C4B3E0414D31C9E68AE14B7E6C037AA6E11BFF5D0B4B1EB13884BA66B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\RCX916C.tmp
- Size 336KB
- SHA256 f36ba6c6ed307002cb056da643c274f579acdabf53275b495d6dbe6f87b06541
- MD5 9d49a2b93c4a041bb79b282db8d5fbb0
- SHA1 b7d4dedbc074f7601beaca63762f7b3251d48068
- SHA512 c2c272f6ed52bc76837b044c6bbb98d9bbe954f3cda2c086615b1e65d6cbf8343eb98e958dbab2bf03474019fcfc30f7ef2beeac80deaafc03b4cedf3ca6316e
- SSDEEP 6144:iFlKgzelZNQSBQGH/CSpWqTStnRPF9cCGryoAXjiU4bz:lfBQGH6SfanRNhZoAX+U4
- TLSH T11C74F1567E93D4B3D040493098A78BC2873B6C57AA66E103FFE93E472FB13905A73652
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome.exe
- Size 1.5MB
- SHA256 92b081e9a140ca6f1aae5524c05a789e269b2dccb296acfe0ac8034c4f3dceb1
- MD5 73ba39e4f1e235e434ed99ac0768014a
- SHA1 4a53ac6b35985fdd0b7885df2bffd6f566f20803
- SHA512 d629bd70d988267c8ecc2cd6498e75607532502bd1f367519bc27813fea2bb7bf001a220a72ffe5c82a4425743bbe0bdf90812340f9a78fc7ebfa52740d74c4c
- SSDEEP 6144:WFlKgzelZNQSBQGH/CSpWqT9tnRPF9cCGrWoAXjiU4bz:RfBQGH6Sf7nRNhhoAX+U4
- TLSH T1F675F1567E93D4B3D040493098A78BC2873F6C47AA66E113FFA93E472FB13905A73652
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\RCX92ED.tmp
- Size 284KB
- SHA256 de64e64477853504823b3a0042a278d8e63225233bc58938e05fffe43989b067
- MD5 15b59538fdd811c7f6f88d54fac8be01
- SHA1 9e7e1191a79e0d23c09b1db39e42a30700e81ac4
- SHA512 ce6e51c1ac7484d0813279e6537e01aa525cf06adcbc5d56cc2f11218f10c6a91cb48416106e9b63913d10817b153a9134a8053c81337429c7ba451421923405
- SSDEEP 6144:zFlKgzelZNQSBQGH/CSpWqTEoAXjiU4bz:cfBQGH6SfwoAX+U4
- TLSH T1585402457D93C4B3D0414D3188E68BE18B7F6C137AA6E11BFB5D0B4B1EB13844BAA261
- MD5 SHA1 SHA512 SSDEEP TLSH