Overview

overview

10

Static

static

10

2026-08-02...er.exe

windows10-2004-x64

10

2026-08-02...er.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    126s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    03/08/2026, 00:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-02_43b35226f168170e82473a7d5bbad7ff_elex_rhadamanthys_smoke-loader.exe
  • Size 288KB
  • Sample260803-att4sshh85
  • SHA256 aa122ff6b27b409873bb9a9f71bd9c06ec863d8b4d855647a8b85e8e1bbd7a6a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarediscoverycosmuransomwarespywareworm

Malware Config

Signatures

  • Family: Cosmu

    Cosmu is a Windows worm written in C++.

    wormcosmu
  • Detects Cosmu payload 4 IoCs

    Cosmu is a worm written in C++.

  • Enumerates connected drives 3 TTPs 10 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-02_43b35226f168170e82473a7d5bbad7ff_elex_rhadamanthys_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-02_43b35226f168170e82473a7d5bbad7ff_elex_rhadamanthys_smoke-loader.exe"
    1⤵
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    PID:1104

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 331KB
        • SHA256 b907603198b4b1e2ef201ed89845b2739131d30209fd581ba157c69905a0bede
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RCX74FB.tmp
        • Path C:\Program Files\Google\Chrome\Application\RCX74FB.tmp
        • Size 288KB
        • SHA256 5408daa15a4746ceb92db6b698590f205416a927c09b96b3b0d3d25f04aaca45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RCX763E.tmp
        • Path C:\Program Files\Java\jdk-1.8\bin\RCX763E.tmp
        • Size 288KB
        • SHA256 91749338806c694e27db41aa0526cb73c0efabd7b58fa4d4a403cba2a1d66ab1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        crashreporter.exe
        • Path C:\Program Files\Mozilla Firefox\crashreporter.exe
        • Size 1.5MB
        • SHA256 82b7237a3d1c1f7d977359a121127f92365425eafe2008fb1ce3aadabe87f391
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download