Analysis
- max time kernel
148s - max time network
117s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/08/2026, 05:03
Behavioral task
behavioral1
Sample
2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe
- Size 284KB
- Sample260803-fpzrdacd43
- SHA256 73fdf6f1d4f983c88246a52f906373153cfa5b41148ee3d94b50d3aae520e640
- MD5 802881ad1436e128861792d06db1d76c
- SHA1 52ad83ed63022dfc920f3126de99b67b3dbbf68a
- SHA512 724bc1e3c4db43cec2af4e72b00ff6de2d1e5ac17d732d824b1d2d93f251aab1489ccde93f4ee12d7da5a4e164cc1108813ffbed04e55ea2bd761cbdd9686743
- SSDEEP 6144:YFlKgzelZNQSBQGH/CSpWqT5oAXjiU4bz:vfBQGH6Sf9oAX+U4
- TLSH T13A5402457D93C4B3E0414D3188E68BE15B7F6C137AA6E11BFB9D0B4B1EB13884BA6271
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Cosmu payload 6 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000d00000001c5aa-6.dat family_cosmu behavioral2/files/0x000400000001bad5-81.dat family_cosmu behavioral2/files/0x000700000001bad5-116.dat family_cosmu behavioral2/files/0x000300000001bac6-153.dat family_cosmu behavioral2/files/0x00050000000188c2-192.dat family_cosmu behavioral2/files/0x000700000001b8d6-249.dat family_cosmu - Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\H: 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\J: 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\M: 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\N: 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\O: 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\D: 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\I: 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\K: 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\L: 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCX5BFE.tmp 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.cab 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ielowutil.cab 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.cab 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCX5BDE.tmp 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX5C9C.tmp 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.cab 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX5E99.tmp 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX5EFA.tmp 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCX5BFF.tmp 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome.cab 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCX612A.tmp 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX5EA9.tmp 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX5CAF.tmp 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX5CAE.tmp 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX5B59.tmp 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.cab 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX5D14.tmp 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX5DF7.tmp 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.cab 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.cab 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.cab 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.cab 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX5B46.tmp 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\dotnet.cab 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX5CD0.tmp 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ExtExport.cab 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX5F0B.tmp 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX6109.tmp 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX5D24.tmp 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7z.cab 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX5BAB.tmp 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.cab 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX5DD5.tmp 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.cab 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX5D00.tmp 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.cab 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX5D56.tmp 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.cab 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX5BBC.tmp 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX5D46.tmp 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX5E18.tmp 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\crashreporter.cab 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX5B99.tmp 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_802881ad1436e128861792d06db1d76c_elex_rhadamanthys_smoke-loader.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5356
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 330KB
- SHA256 4da168113e7e6bd6b6ca432af63bb984d40efe1de45a5cb56fd9c48d4bdc4e9c
- MD5 827fac10070232df1694df2a05c0ae02
- SHA1 5ba8720b21edba68e67d3f735478ed2d48c54df8
- SHA512 a545b671e401237440cfa08d4792a494634a900a138327314798196a9756fee5880855b431edbbcff307113e24929aed8eac37a67aba3e4a92fe77cd66562c88
- SSDEEP 6144:nFlKgzelZNQSBQGH/CSpWqTyoAXjiU4bz:4fBQGH6SfeoAX+U4
- TLSH T19C74F1457D93C4B3E0414D31C9E68AE14B7E6C037AA6E11BFF5D0B4B1EB13884BA66B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 1.5MB
- SHA256 22077e9c2431239f08f77c7620caeeb136fe24bad79d05fa4458cbaf6d328343
- MD5 d6e3d21a929e8ab98f8f8005699918ab
- SHA1 1620b76f1ec41b5e78737e757d633bcc039d3038
- SHA512 5d08060716290ae38dffb9bd47a5bd4f7832514defa48d49271df43c9ad5bb7e9492b7252c904f9d2143e74cbb9ef61dde37eb597cf8512b877acbfc388d22a7
- SSDEEP 6144:3FlKgzelZNQSBQGH/CSpWqTVoAXjiU4bz:ofBQGH6SfZoAX+U4
- TLSH T1FC6502457DA3C4B3D0414D3188E68BE19B7F6C13BAA5E11BFB9D0B4B1EB13844B6A361
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\RCX5CCF.tmp
- Size 284KB
- SHA256 8a55ce0d8b6ae1e2d402677187d2e1db01b053a8efbea4df27211f4aac4153db
- MD5 147328d17e56f0b9c550706192b9f2a0
- SHA1 80c273e768ce7d409b468cbb82b6524b2e9cb962
- SHA512 aa3b60e2d69882ac03074b52f31f5e5d99ceb48f26df37b709145a69c745709dd1b1b7ec7925ff2e97a013776333967cd4cd936fe4283c4197a42b60e08fc70d
- SSDEEP 6144:DFlKgzelZNQSBQGH/CSpWqTRoAXjiU4bz:MfBQGH6SfdoAX+U4
- TLSH T19954F1457D93C4B3D0414D31C9E68BE14B7E6C037AA6E11BFB5D0B4B1EB13884BAA6B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome.exe
- Size 1.5MB
- SHA256 7f71b3416c2406d4f1a57a3577fb384e5a8f4e0e7573b19fef2a5fa11d4411ba
- MD5 59f836ce77ed3f9a382318c4c36865c6
- SHA1 8799bcb85a47d78e49af7605d925971b29de2682
- SHA512 c21492c20e00bafa247b55743a387619549b3952076de7303d4795f3f2da74eef69e0ee951b7d6156d03286e9007b6f6cc7e1a21aed832b129fafadf487d4ad9
- SSDEEP 6144:QFlKgzelZNQSBQGH/CSpWqTxGYxlkBx3aoAXjiU4bz:nfBQGH6SfNGYUBUoAX+U4
- TLSH T145650141BE83DCB3D001053188E78BE1177E9D13A676D217FF9D1A0B2EB238556B7A62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\RCX5F1C.tmp
- Size 284KB
- SHA256 d55b5e70a0020f61c078e502d5d7bae04ae8d63c612207e5f77aef690da85ff9
- MD5 9954ba5c86d420d750fc9561b609ed29
- SHA1 0f17e87b48999a8c4727088d2606912df6dc4b9c
- SHA512 9f18b801188e684703dc6c5be39027bb65fe7a3c7ba32f743a483f4f17b8df28df76f5674dbe77ae7a9a5332e19a8d8b1a7422ee32f785302eeaf2b7dc26d0f3
- SSDEEP 6144:3FlKgzelZNQSBQGH/CSpWqTEoAXjiU4bz:ofBQGH6SfwoAX+U4
- TLSH T1BD5402457D93C4B3D0414D3188E68BE19B7F6C137AA6E11BFB5D0B4B1EB13844BAA271
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe
- Size 354KB
- SHA256 6865809726e1f19e503165a4994dbee5cd84045febf8a1035883384c19b820c6
- MD5 7aecdbe11468000ec8d1bf51c26577d8
- SHA1 469f21b130d6f8e55a86acdd7c51d85300340b68
- SHA512 f16d1aa8590063e1742feadbf1ee6a341ec27aadab882cd1a82a10b570a52bd799963e0ffe4e4bfe74b34d681c23f6e78e15c0658fde482661e721584543c646
- SSDEEP 6144:XFlKgzelZNQSBQGH/CSpWqT3UjD56oAXjiU4bz:IfBQGH6SfDUjD56oAX+U4
- TLSH T16074F1413E93C4F3D440093188A78FE19B3F6C23BAD5E207FB993B4B9EB13845A66655
- MD5 SHA1 SHA512 SSDEEP TLSH