Analysis
- max time kernel
148s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/08/2026, 00:29
Behavioral task
behavioral1
Sample
2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe
- Size 288KB
- Sample260803-atdf2shp7s
- SHA256 b6c7068e41f18fd4e8c2f0ecb304d3c3979edb03619457d1cdb2323f9656643a
- MD5 462f3b337971abe0d15cc15c68004351
- SHA1 8bf39b487a3de50aea2ed016d48367e1169a2bd1
- SHA512 423fc8450b721625fb1e4cf43f9f4d58ba00e85878101f04e21561b115edd79f48d8d1bc5bb291bb31c18978b9e4d9ed06ae2c8f3453ef55b9e46129c9efde57
- SSDEEP 6144:NFlKgzelZNQSBQGH/CSpWqT9oAXjiU4bzV:KfBQGH6SfBoAX+U4l
- TLSH T14054F1917AA2D8B3D4429A314CA68F6197377D139A65D203B7AD1F4B2F713D09B3B302
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Cosmu payload 3 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000c00000001c553-7.dat family_cosmu behavioral2/files/0x000d00000001c55b-82.dat family_cosmu behavioral2/files/0x0007000000018975-193.dat family_cosmu - Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\H: 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\J: 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\K: 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\M: 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\G: 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\I: 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\L: 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\N: 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\O: 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe - Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Control Panel\Desktop\Wallpaper = "C:\\windows\\WallPapers.jpg" 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\Office16\RCX360D.tmp 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.cab 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.cab 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX34DC.tmp 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.cab 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX35C8.tmp 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7zFM.cab 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX3521.tmp 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX3552.tmp 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX3630.tmp 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX3335.tmp 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\dotnet.cab 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX34BC.tmp 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX34EE.tmp 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.cab 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.cab 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX35EB.tmp 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX3575.tmp 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX35FD.tmp 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7z.cab 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCX3355.tmp 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.cab 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.cab 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCX3653.tmp 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX3520.tmp 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.cab 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX3564.tmp 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.cab 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX35D8.tmp 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7zFM.exe 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.cab 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX3474.tmp 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX34FE.tmp 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX3563.tmp 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7z.cab 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iexplore.exe 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX32DE.tmp 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\dotnet.exe 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCX3367.tmp 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iediagcmd.cab 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.cab 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\windows\readme.1xt 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe File created C:\windows\WallPapers.jpg 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Desktop\General 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe Set value (str) \REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Desktop\General\WallpaperSource = "C:\\windows\\WallPapers.jpg" 2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_462f3b337971abe0d15cc15c68004351_elex_rhadamanthys_smoke-loader.exe"1⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:4232
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 330KB
- SHA256 143963af17d61ae489405a7bd9f6300060926b2084215fcfccdf9a22cd775069
- MD5 a1b72140cac1bc6ab3a1235f032b653f
- SHA1 fafc5ceefa6ff0a3c7ab41f0c75c630b1dbe1f3c
- SHA512 f3187c9be20f2c6627fc33f7887ca9cf8c6de076e1eddf84e6a7968164ca52436d814588d3618b7bf59e2af1dd0e87bab058c8c1ed883f19143a679e790e4ee9
- SSDEEP 6144:eFlKgzelZNQSBQGH/CSpWqTvoAXjiU4bz:ZfBQGH6SfboAX+U4
- TLSH T1127401817DA3D8B3D041493188A6CBA1973B6D13AA65D203FB9D0F4B2FB13D49B7A351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\RCX3496.tmp
- Size 288KB
- SHA256 4bf82a9df296646e444862c0413bc7b2a99a8c1a16a189c2f551a9c569fd965b
- MD5 4d2be2eb6f40a1553504e43086b8e496
- SHA1 b7dd3a45eecda6b87eda59977614919a02e9f7a3
- SHA512 5de25022b20ec73f59163c2b81a17f36d09610dd1c41ac6fd93c0536fec32cc3299a93be9465f3a29e532eb3fd4a6d3bbba48d4f371a68b57fe7e51f6f6e00f6
- SSDEEP 6144:yFlKgzelZNQSBQGH/CSpWqTVoAXjiU4bz:VfBQGH6SfRoAX+U4
- TLSH T17F5401917DA2D8B3D041493188A6CFA1973B6D13AA65D203FB9D0F4B2FB13D49B7B241
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\RCX35D9.tmp
- Size 288KB
- SHA256 7db12a032c7153fd38ca9f4fa2a97c9da877b957700c0cfc5e446f4a7a4274db
- MD5 1f9b43322ee392b5d5b21dfef8c130ef
- SHA1 f03bbd2c10615223a172176f64de6d0530c6c556
- SHA512 bb501e020e168c010fdab1dbc0b03d4134ea6fefcb9c718edf20cb425168dcf077928aec63bd364d8f13c6ba965639587cc77c552c4695214f75ad5bad9298e1
- SSDEEP 6144:2FlKgzelZNQSBQGH/CSpWqTsoAXjiU4bz:xfBQGH6SfooAX+U4
- TLSH T1BA5401917DA2D8B3C0419A3188A6CBA197376D139A65D203FBAD1F4B2F713D49B7B301
- MD5 SHA1 SHA512 SSDEEP TLSH