Analysis
- max time kernel
150s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 23:44
Behavioral task
behavioral1
Sample
2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe
- Size 2.1MB
- Sample260802-3rb5eshj3t
- SHA256 7ee3ba46040307651086272d532be0fb2ab64307493dd4c3cd08c4b198db1087
- MD5 c1176d7ef32d3740c3610758a9292456
- SHA1 a77677cdf9033202829488cdf78e58e447d62258
- SHA512 3a4988bbbe28c38c7701d40b39d671e7434660d1ce78d44b9c99b605bb3d9d38cadcc9357df02ac0810e769789c5556930d856c17570e14e0eaf10e2a90802b6
- SSDEEP 6144:EFlKgzelZNQSBQGH/CSpWqTbHHHHHHHCoAXjiU4bz:jfBQGH6SfHHHHHHHHCoAX+U4
- TLSH T1D0A5A5E42741A76DE5F30A3A0654857423F73E8B7C8E72B26D55370BAA30960B7CB21D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Cosmu payload 3 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000c00000001c5c6-7.dat family_cosmu behavioral2/files/0x000d00000001c5cd-82.dat family_cosmu behavioral2/files/0x000700000001895d-193.dat family_cosmu - Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\H: 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\I: 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\K: 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\M: 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\N: 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\O: 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\G: 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\J: 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\L: 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe - Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Control Panel\Desktop\Wallpaper = "C:\\windows\\WallPapers.jpg" 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7zFM.cab 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ieinstal.cab 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.cab 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iexplore.cab 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX2F4C.tmp 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.cab 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iediagcmd.cab 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX2F18.tmp 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\dotnet.cab 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX3094.tmp 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX30C8.tmp 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ExtExport.cab 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.cab 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX2EF7.tmp 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX304E.tmp 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX314F.tmp 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.cab 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX3182.tmp 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\readme.1xt 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.cab 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ielowutil.cab 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX3181.tmp 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7z.cab 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.cab 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ieinstal.exe 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX2F1A.tmp 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX303D.tmp 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX312E.tmp 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCX2F6D.tmp 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX304F.tmp 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX310D.tmp 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.cab 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX32E4.tmp 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.cab 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCX2F7F.tmp 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ExtExport.exe 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome.cab 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.cab 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.cab 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.cab 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\crashreporter.cab 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX2F07.tmp 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX3061.tmp 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.cab 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\windows\WallPapers.jpg 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe File created C:\windows\readme.1xt 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Desktop\General 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe Set value (str) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Desktop\General\WallpaperSource = "C:\\windows\\WallPapers.jpg" 2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_c1176d7ef32d3740c3610758a9292456_elex_rhadamanthys_smoke-loader.exe"1⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:6056
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 336KB
- SHA256 690658ed472341bdb7ef35274d63407fef8505806ea99809e1178d3139463285
- MD5 9f62d502fcaf1a3b3e76d5e5fadf4098
- SHA1 ae581ad2384ef153da347b71b89d5934e3d143cc
- SHA512 24e9d01cb1beae0e093bc5e2e693a69163f9169486226283b0269666c8febe57b0e7198bac0c43caa44e3377949ec9ef22f502861a61d9b4f71a09851199eece
- SSDEEP 6144:VFlKgzelZNQSBQGH/CSpWqTvoAXjiU4bz:yfBQGH6SfboAX+U4
- TLSH T1B07401817DA3D8B3D041493188A6CBA1973B6D13AA65D203FB9D0F4B2FB13D49B7A251
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\RCX3060.tmp
- Size 288KB
- SHA256 cb9c60c4e0c3be2640ba29c6b65e2afe2511cc2b8886c059d85221fb40d8c39f
- MD5 96ebf2609bfe27593eceefe278714873
- SHA1 bd1eba818419e820b3f98b850f021621e923cbb3
- SHA512 7621ada86d7fb45ac90962293b50c32fc95b9922c009210eb18643cf0deb5b8aeb7a36b050cd642e977fe1221ca1abbc19292d8c5d1621216134309f2b64cf93
- SSDEEP 6144:JFlKgzelZNQSBQGH/CSpWqTVoAXjiU4bz:+fBQGH6SfRoAX+U4
- TLSH T1515401917DA2D8B3D041493188A6CFA1973B6D13AA65D203FB9D0F4B2FB13D49B7B241
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\RCX3194.tmp
- Size 288KB
- SHA256 d3b57bd28b887e6bd16cd95645a4f0dacb7e98f7d03fc03e1fb2c4e60f6be4f3
- MD5 c19464d5f1dc21d96ef00504c3713d6c
- SHA1 3dc8ca3cd00cb2469320ad38b4d865cd664b9fb2
- SHA512 341e8cd8f34f63ef74800ee2b1f7785c7443c5e0f6ff8e75372dee69cbfcc265f490ebaa9bdc88365638cd84108042c38c998f7d8ef7022e32f2f421395983dd
- SSDEEP 6144:VFlKgzelZNQSBQGH/CSpWqTsoAXjiU4bz:yfBQGH6SfooAX+U4
- TLSH T1E25401917DA2D8B3C0419A3188A6CBA197376D139A65D203FBAD1F4B2F713D49B7B301
- MD5 SHA1 SHA512 SSDEEP TLSH