Analysis
- max time kernel
148s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 02:44
Behavioral task
behavioral1
Sample
2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe
- Size 288KB
- Sample260804-c7472atyds
- SHA256 e73e2207def4068d75ba0d60bb6fee896d735ad9b73d6f8aad9db4b37fcd9a64
- MD5 a01f1ebb1ab2bf9f98e525447729eba6
- SHA1 a6e1edfa5497454df05f1e918c9808839e82e8bc
- SHA512 7d748cf5d7f85053bb2e2a375a61257fd572718fdca57daa6b535c3acc08245a6e67daf53fde6daf3d309de13f86516ffa4dd5266500755f67c194218e99c94e
- SSDEEP 6144:9FlKgzelZNQSBQGH/CSpWqTmoAXjiU4bzV:afBQGH6SfqoAX+U4l
- TLSH T18F5401917AA2D8B3C4429A3148A6CF6197377D139A65D203B7AD1F4B2F713D09B7B302
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Cosmu payload 3 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000d00000001c469-7.dat family_cosmu behavioral2/files/0x000e00000001c471-82.dat family_cosmu behavioral2/files/0x000500000001898c-193.dat family_cosmu - Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\G: 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\K: 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\L: 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\D: 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\H: 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\I: 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\J: 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\M: 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\N: 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe - Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Control Panel\Desktop\Wallpaper = "C:\\windows\\WallPapers.jpg" 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Internet Explorer\iediagcmd.cab 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCX3DA7.tmp 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ExtExport.cab 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCX41AD.tmp 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX40F2.tmp 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.cab 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX3EEF.tmp 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX3F79.tmp 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCX41AC.tmp 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX3ECF.tmp 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\dotnet.cab 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7z.exe 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\dotnet.exe 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.cab 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.cab 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\dotnet.cab 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX3EAA.tmp 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.cab 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX4114.tmp 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.cab 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX3D2E.tmp 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCX3DC8.tmp 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX3E87.tmp 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX3F01.tmp 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX3F46.tmp 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.cab 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX4199.tmp 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX3ECE.tmp 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX3F36.tmp 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX3F78.tmp 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.cab 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ieinstal.exe 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.cab 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.cab 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX3D75.tmp 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iexplore.cab 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.cab 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.cab 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.cab 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.cab 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\crashreporter.cab 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX419A.tmp 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCX3DA8.tmp 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX3F13.tmp 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX4104.tmp 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX4156.tmp 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCX41AB.tmp 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX3EF0.tmp 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\windows\readme.1xt 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe File created C:\windows\WallPapers.jpg 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Desktop\General\WallpaperSource = "C:\\windows\\WallPapers.jpg" 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe Key created \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Desktop\General 2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_a01f1ebb1ab2bf9f98e525447729eba6_elex_rhadamanthys_smoke-loader.exe"1⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:3368
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 326KB
- SHA256 861260c9219136a51289598ce650e0e38612c19d42aeeb8d9fb334478832398f
- MD5 1efd0c297a10549ed652117cf0f0a722
- SHA1 af5612bfe762a1c1aa9cd5009aa63ec327c7b913
- SHA512 4712f1375de0e9138660ed932061406cae4235765958be990ae6664c8640d1ef8c1bd9d9de8d87e456c55e4fc71a44d9dffc83322c2b5961226582fec3fdff3f
- SSDEEP 6144:eFlKgzelZNQSBQGH/CSpWqTvoAXjiU4bz:ZfBQGH6SfboAX+U4
- TLSH T1A66401817DA3D8B3D041493188A6CBA1973B6D13AA65D203FB9D0F4B2FB13D49B7A351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\RCX3E99.tmp
- Size 288KB
- SHA256 4bf82a9df296646e444862c0413bc7b2a99a8c1a16a189c2f551a9c569fd965b
- MD5 4d2be2eb6f40a1553504e43086b8e496
- SHA1 b7dd3a45eecda6b87eda59977614919a02e9f7a3
- SHA512 5de25022b20ec73f59163c2b81a17f36d09610dd1c41ac6fd93c0536fec32cc3299a93be9465f3a29e532eb3fd4a6d3bbba48d4f371a68b57fe7e51f6f6e00f6
- SSDEEP 6144:yFlKgzelZNQSBQGH/CSpWqTVoAXjiU4bz:VfBQGH6SfRoAX+U4
- TLSH T17F5401917DA2D8B3D041493188A6CFA1973B6D13AA65D203FB9D0F4B2FB13D49B7B241
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\RCX4114.tmp
- Size 288KB
- SHA256 7db12a032c7153fd38ca9f4fa2a97c9da877b957700c0cfc5e446f4a7a4274db
- MD5 1f9b43322ee392b5d5b21dfef8c130ef
- SHA1 f03bbd2c10615223a172176f64de6d0530c6c556
- SHA512 bb501e020e168c010fdab1dbc0b03d4134ea6fefcb9c718edf20cb425168dcf077928aec63bd364d8f13c6ba965639587cc77c552c4695214f75ad5bad9298e1
- SSDEEP 6144:2FlKgzelZNQSBQGH/CSpWqTsoAXjiU4bz:xfBQGH6SfooAX+U4
- TLSH T1BA5401917DA2D8B3C0419A3188A6CBA197376D139A65D203FBAD1F4B2F713D49B7B301
- MD5 SHA1 SHA512 SSDEEP TLSH