Analysis
- max time kernel
148s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 06:20
Behavioral task
behavioral1
Sample
2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe
- Size 284KB
- Sample260804-g3ylxaxyft
- SHA256 7cd4d3ffcc2c7f7585b3675807572b8a8ec9a48871496afc70f7cf06ae7afa7b
- MD5 8e8b49e8f3bf49d7a1335eefe4f32e19
- SHA1 0b211def91eb736fe02d4ffb0db2e47f2ecb98d9
- SHA512 ebad5ef13f174d1c67f55f8253e85e7451daa581ff2effa098731dba376d726b05cee902e171d9cee83f8b3a5a6ec4f28982ce6ae4d30ea74d55b4b62724d573
- SSDEEP 6144:sFlKgzelZNQSBQGH/CSpWqTToAXjiU4bzV:rfBQGH6SfnoAX+U4l
- TLSH T11654F2457DA3D4B3D0414D3188E68BE18B7F6C137AA6E11BFB9D0B4B1EB13844B6A361
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000e00000001c535-6.dat family_cosmu behavioral2/files/0x000d00000001c542-81.dat family_cosmu behavioral2/files/0x000300000001bb57-173.dat family_cosmu behavioral2/files/0x0004000000019b65-206.dat family_cosmu - Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\D: 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\G: 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\O: 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\H: 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\I: 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\J: 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\K: 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\L: 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\M: 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\7z.exe 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCXABBD.tmp 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iexplore.cab 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.cab 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCXABBE.tmp 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCXAC40.tmp 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7z.cab 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXAAF5.tmp 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.cab 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.cab 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ieinstal.cab 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCXAC50.tmp 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.cab 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.cab 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCXACD7.tmp 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.cab 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCXAB6A.tmp 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\RCXACA5.tmp 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCXACC7.tmp 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXAAD1.tmp 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ielowutil.cab 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCXA7C1.tmp 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.cab 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\readme.1xt 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCXA7B1.tmp 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\dotnet.exe 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.cab 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCXACC6.tmp 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.cab 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCXA9B0.tmp 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCXA9E0.tmp 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCXACE9.tmp 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXAABF.tmp 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXAAE3.tmp 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ExtExport.exe 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iediagcmd.cab 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCXAC62.tmp 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.cab 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCXACE8.tmp 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCXA96D.tmp 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXAAE4.tmp 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_8e8b49e8f3bf49d7a1335eefe4f32e19_elex_rhadamanthys_smoke-loader.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3412
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 332KB
- SHA256 cd9a9dd42c2724dcce71aac036fb078c2121eaa86ffb98069bf19d91b122516f
- MD5 8239f241cd0a6549fa4565671dd4750a
- SHA1 5181265783dd2cb898ec02e14af4276e299e6400
- SHA512 5e896eaaa956216b7b201c502415a6db6d9285d5499707c4fa1858cd7d4769a4630389a9dad27af8e0dcccfd668cb97d1b57b474e1e462cf1eb8f21f6b0f1103
- SSDEEP 6144:XFlKgzelZNQSBQGH/CSpWqTyoAXjiU4bz:IfBQGH6SfeoAX+U4
- TLSH T1F174F1457D93C4B3E0414D31C9E68AE14B7E6C037AA6E11BFF5D0B4B1EB13884BA66B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 284KB
- SHA256 8f68e2cb2e51d5d84ee270174d25e12675b63aacd16a09fd5967d01d76d9fc73
- MD5 f36cec6424da7b991a4df8eedae38df0
- SHA1 2602956b38131879c65c8999f2c9a4ca912e8be3
- SHA512 360472881c3901cda100381476fdd7149201f5407c3b6057d8f1a04d26baf4e54ce5254888b0a312d3f49b8a088b13d6b2ab1deee18f2723d99fedd4a3f19ea7
- SSDEEP 6144:nFlKgzelZNQSBQGH/CSpWqTfoAXjiU4bz:4fBQGH6SfzoAX+U4
- TLSH T17A5402457D93D4B3D0414D3188E78BE18B7F6C137AA6E11BFB9D0B4B1EB13884BA6261
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\RCXAAD0.tmp
- Size 284KB
- SHA256 280a850e755de4eb224b56ff71f7d60f19ce6c12fde4382d8ccc3a7792376cdd
- MD5 a84f251c852b9b9954477448d1b0392d
- SHA1 5bf61cac08e7f71a395168b5fb0b03937b589f77
- SHA512 62323a9018a928bfbfa80ec2905ccc95e10085d3b0ba159cb3d5b7489a141ce601f0f260757fc4939758cd8dde1111590757cec720a53a81d0e087ae391c4850
- SSDEEP 6144:zFlKgzelZNQSBQGH/CSpWqTRoAXjiU4bz:cfBQGH6SfdoAX+U4
- TLSH T19154F1457D93C4B3D0414D31C9E68BE14B7E6C037AA6E11BFB5D0B4B1EB13884BAA6B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\jabswitch.exe
- Size 284KB
- SHA256 1b28fac993720d22813729931baf2680b79e86f08958f075a0d040948ac61c86
- MD5 8131be2d1a12a75cff305ce5d836822c
- SHA1 7e17224a586a6d42d39f2e78f0fbac7ce007086b
- SHA512 24ec1c33a711c65491447419997bd7f3c59c0346e332378bccf2806e0a8719f66b60c0a17e7c3051cded80024f68fc3a21bc87ce63304fb3ea7a85409fa296e8
- SSDEEP 6144:nFlKgzelZNQSBQGH/CSpWqTloAXjiU4bzF:4fBQGH6Sf5oAX+U41
- TLSH T1035402457D93C4B3D0414D3188E68BE19B7F6C137AA6E11BFB9D0B4B1EB13844BAA361
- MD5 SHA1 SHA512 SSDEEP TLSH