Analysis
- max time kernel
148s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 05:42
Behavioral task
behavioral1
Sample
2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe
- Size 288KB
- Sample260802-gef2ystwew
- SHA256 f563a3dae123b9ea4d155cb33c66773fd047d86420766b720333cdc5dfcaf951
- MD5 9c2e86f4d2abada364085c855a72244a
- SHA1 8f5be96b958ef2165b9a7fa4c218894287e20ea9
- SHA512 267a2ffa64d83858c498b234adb0984b726e953ac63265ce0ec45fee4e630a079a64fe37ce07a7d52b7570c92829118c3f945cdb142d20f1e60f34187b78d7fd
- SSDEEP 6144:AFlKgzelZNQSBQGH/CSpWqT9oAXjiU4bzF:3fBQGH6SfBoAX+U41
- TLSH T13854F1917AA2D8B3D4429A314CA68F6197377D139A65D203B7AD1F4B2F713D09B3B302
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Cosmu payload 3 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000e00000001c466-6.dat family_cosmu behavioral2/files/0x000e00000001c471-81.dat family_cosmu behavioral2/files/0x000600000001898a-192.dat family_cosmu - Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\H: 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\I: 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\J: 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\K: 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\N: 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\O: 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\G: 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\L: 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\M: 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\RCXF923.tmp 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCXFADF.tmp 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome.cab 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXFC49.tmp 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCXFD02.tmp 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCXFD58.tmp 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCXFD68.tmp 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\dotnet.cab 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.cab 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCXFD89.tmp 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.cab 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXFC89.tmp 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.cab 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCXFAFF.tmp 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.cab 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\crashreporter.cab 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCXFDAD.tmp 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.cab 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCXFD25.tmp 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCXFADE.tmp 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCXFB42.tmp 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.cab 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXFC36.tmp 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCXFCD0.tmp 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ExtExport.exe 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7z.cab 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXFBEE.tmp 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXFC24.tmp 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCXFD9C.tmp 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.cab 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.cab 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXFC13.tmp 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.cab 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCXFD47.tmp 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.cab 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7zFM.cab 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7zFM.exe 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.cab 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCXFD24.tmp 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.cab 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCXFD9B.tmp 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.cab 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_9c2e86f4d2abada364085c855a72244a_elex_rhadamanthys_smoke-loader.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2820
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 339KB
- SHA256 4bea37023ca3492b1f7a8e6cf87bc4d5c9daa88de038a6b72d5845d4cc5457bb
- MD5 3d4c0cca2bc52ffb24dee6e4888dce21
- SHA1 0a08435236c39032fefa425c5003558a16799153
- SHA512 579a183c203876a9f2e281265bf529ec74da5d3e4de59fd0f97311a08fdf170d861c03906c4470145a8d51b7c1cd86e0618ab95bb9741e809724051e9955e81e
- SSDEEP 6144:rFlKgzelZNQSBQGH/CSpWqTvoAXjiU4bz:UfBQGH6SfboAX+U4
- TLSH T1747401817DA3D8B3D041493188A6CBA1973B6D13AA65D203FB9D0F4B2FB13D49B7A251
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\RCXFC12.tmp
- Size 288KB
- SHA256 2180cfc65d8355bf68dc07b15c3202c05e50347890e8b709b7709cb9ce6577cc
- MD5 e69a5134b97b254f05eb0f0c3bfda588
- SHA1 ff7a31ccdea4a5d92551bbc218ec0dcaea13149a
- SHA512 bc1cdb1a265dbf8df9825031648a146862837abc822b2685c72e0cdbd6849d03b52f06b6b4dbbe6ec68a4ffd09aa1e4af0715a63efa9b92e49c9cfdcc1f41c5a
- SSDEEP 6144:3FlKgzelZNQSBQGH/CSpWqTVoAXjiU4bz:ofBQGH6SfRoAX+U4
- TLSH T1935401917DA2D8B3D041493188A6CFA1973B6D13AA65D203FB9D0F4B2FB13D49B7B241
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\RCXFD35.tmp
- Size 288KB
- SHA256 ab97ec5168d67ade767964e9b4f568f77152244b1d6d8e2b13410bc1a02def7b
- MD5 ff3baa1d4d2ddf53f158015faf958dd2
- SHA1 e5045d289483b5e90ff25ab9f4c76a4c98b1ae25
- SHA512 021ccb0c657794550e20116278916e4bdc9cd98a9c5bae85909f35a96089e60c95f716fafe000ca06e66fab49680ea8ca35035ac3013b7e80b3cd879513d1b9f
- SSDEEP 6144:7FlKgzelZNQSBQGH/CSpWqTsoAXjiU4bz:EfBQGH6SfooAX+U4
- TLSH T1CE5401917DA2D8B3C0419A3188A6CBA197376D139A65D203FBAD1F4B2F713D49B7B301
- MD5 SHA1 SHA512 SSDEEP TLSH