Analysis
- max time kernel
148s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/07/2026, 20:03
Behavioral task
behavioral1
Sample
2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe
- Size 344KB
- Sample260727-ys1rysda45
- SHA256 394cdb429460b918f6f5ae096ae98e57ba149f0cbf07f25fef4d9068effd83ab
- MD5 79237a4f2f25ccef0e9146e0ba7fb557
- SHA1 2660df7a4923fe0935634a34eaa39ebc0bedccd9
- SHA512 ba1da0887d6609e9dc0450c6005988cdaab5018b23c9dffa80b5f82665497d86b29ff2fb9b5609c4844e9b0d0bbb3cd28ee1b4590303a1b828568c6c74829ba9
- SSDEEP 6144:JFlKgzelZNQSBQGH/CSpWqT9w7oAXjiU4bz:+fBQGH6Sf27oAX+U4
- TLSH T1C574E0403A9ECBB2D3C249318C6EFAA157767C2F9B65D133F7983B4F1E712845A66201
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Cosmu payload 3 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000e00000001c54a-6.dat family_cosmu behavioral2/files/0x000d00000001c556-81.dat family_cosmu behavioral2/files/0x00060000000188c5-192.dat family_cosmu - Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\J: 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\K: 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\L: 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\M: 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\O: 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\D: 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\G: 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\I: 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\N: 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\RCX34EA.tmp 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX379A.tmp 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.cab 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX3851.tmp 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7z.exe 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX3371.tmp 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\readme.1xt 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX355C.tmp 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.cab 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX381E.tmp 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX34D6.tmp 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.cab 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX34C5.tmp 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX356E.tmp 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.cab 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.cab 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.cab 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCX3874.tmp 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCX33A3.tmp 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX381F.tmp 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX37CB.tmp 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX3350.tmp 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX351A.tmp 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ielowutil.exe 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iexplore.cab 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX34E9.tmp 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX333F.tmp 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ExtExport.exe 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\dotnet.exe 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX34B3.tmp 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\RCX3840.tmp 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.cab 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCX33B5.tmp 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ExtExport.cab 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome.cab 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.cab 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX3789.tmp 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\dotnet.cab 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX34A2.tmp 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.cab 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX35D1.tmp 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-27_79237a4f2f25ccef0e9146e0ba7fb557_elex_rhadamanthys_smoke-loader.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1096
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 333KB
- SHA256 a0415dc1844ad23716cb8c3a4f76fbc6424f8c4383a7723825d25fd6658c975f
- MD5 e101bf60c33ac7241907b47f949adefa
- SHA1 02d090b59ee52e7b61eaa80e7387261ca277388e
- SHA512 7eac722909b82b0e043c17a17285a6ee1a5b9b444d69ea2f55a9d02eeb86d35823ddd834696502d4e8bbb1208c4aa5fc5539e7248b3f25b84432181409a4e96a
- SSDEEP 6144:/FlKgzelZNQSBQGH/CSpWqTyoAXjiU4bz:wfBQGH6SfeoAX+U4
- TLSH T1CE74F1457D93C4B3E0414D31C9E68AE14B7E6C037AA6E11BFF5D0B4B1EB13884BA66B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\RCX34C5.tmp
- Size 284KB
- SHA256 29dc3496016135dabb8b40bf8ba675d28351b5f15ab3b48872b10fdf0a264279
- MD5 f1265925b7bcb3db612689c66c8dcf08
- SHA1 171b80ad93d0418c0651636298310a7a76bdc56b
- SHA512 0d1e0be17d94427b1f9aa2e2dd5a42a97da84952b078754f18b5291ed394652633f5f99b6a2162c573d2fdd2de1d597831f6ff4675518a3589d5be621b3622d3
- SSDEEP 6144:bFlKgzelZNQSBQGH/CSpWqTRoAXjiU4bz:kfBQGH6SfdoAX+U4
- TLSH T10B54F1457D93C4B3D0414D31C9E68BE14B7E6C037AA6E11BFB5D0B4B1EB13884BAA6B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\RCX37ED.tmp
- Size 284KB
- SHA256 5998bccf847379d3b87d4975e0fd20a156ef822f022d58cbeec58132f623691c
- MD5 48320c6caef350276d2a717de00556c3
- SHA1 4244878127d8122b9c60b03325a08efaf6a9b08a
- SHA512 680e705f61c63c37fdafbfea18c94b439672d31a45b20895e8619341f85074a76d3a0c0fd7278b9b715112ee732c4eecc58c12f86c73f492c11a9a696950f09f
- SSDEEP 6144:vFlKgzelZNQSBQGH/CSpWqTEoAXjiU4bzd:AfBQGH6SfwoAX+U4t
- TLSH T17A5402457D93C4B3D0414D3188E68BE19B7F6C137AA6E11BFB5D0B4B1EB13844BAA261
- MD5 SHA1 SHA512 SSDEEP TLSH