Analysis
- max time kernel
150s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 06:55
Behavioral task
behavioral1
Sample
2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe
- Size 948KB
- Sample260804-hp28lstcrc
- SHA256 4a8b6f3073c365361595ba22bc6a9aa6366e6f51c42a038255831d40194e6c45
- MD5 6bc50eb98b2a8d968a294f86fc2a1e37
- SHA1 66ae7d9a1c3b1b87263c6465f3b74402c76c4179
- SHA512 cc4a3721ab1c593cbb17c313abb8dd66cb1a8b07807f895d04b3ecd3d45d05b11b4b292615ea9ea979d0f7d705aa23e4604298f9e8ee2c1b9c4fdd60fa472af7
- SSDEEP 6144:pFlKgzelZNQSBQGH/CSpWqTEFPPoAXjiU4bz:efBQGH6SfiPoAX+U4
- TLSH T19225C02162E9CFE1C09F2475DC96B1F40627EE11DD109FDB7E88BE0A39B12A5A93114F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Cosmu payload 3 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000d00000001c50c-6.dat family_cosmu behavioral2/files/0x000c00000001c518-81.dat family_cosmu behavioral2/files/0x0006000000018957-192.dat family_cosmu - Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\G: 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\J: 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\L: 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\M: 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\N: 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\O: 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\D: 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\H: 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\I: 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Internet Explorer\ielowutil.cab 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.cab 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX87BD.tmp 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\dotnet.exe 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.cab 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.cab 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCX8687.tmp 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX8854.tmp 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCX8A5C.tmp 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ielowutil.exe 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iexplore.exe 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7zFM.exe 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX8623.tmp 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX8853.tmp 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ieinstal.cab 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.cab 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX88B8.tmp 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.cab 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX898A.tmp 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX87E1.tmp 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX8622.tmp 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX8798.tmp 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.cab 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX8875.tmp 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX8A4B.tmp 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.cab 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX88F9.tmp 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\dotnet.cab 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.cab 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.cab 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX88FA.tmp 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX8833.tmp 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.cab 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX860F.tmp 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX87BA.tmp 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.cab 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.cab 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.cab 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\crashreporter.cab 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.cab 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX89EC.tmp 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX8886.tmp 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX890A.tmp 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_6bc50eb98b2a8d968a294f86fc2a1e37_elex_rhadamanthys_smoke-loader.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4344
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 328KB
- SHA256 95638851a9fe3d2615ec799256c66b8b8727c6f2d975897f162e5dca0c4d745d
- MD5 eaa034aae9ab3ffad54574c18e0cce63
- SHA1 ac5065d2974769a875d01243ca933a08a2bc67e9
- SHA512 d48f5905e82f8c5ce69bd551c0141d105f1cff58e3e5512a6cfe5c4745a4ff029111112ce93f325a7347a4d847dc06ed8c81d011bf451c58e589bd94550690d5
- SSDEEP 6144:VFlKgzelZNQSBQGH/CSpWqTvoAXjiU4bz:yfBQGH6SfboAX+U4
- TLSH T1546401817DA3D8B3D041493188A6CBA1973B6D13AA65D203FB9D0F4B2FB13D49B7A351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\RCX8798.tmp
- Size 288KB
- SHA256 cb9c60c4e0c3be2640ba29c6b65e2afe2511cc2b8886c059d85221fb40d8c39f
- MD5 96ebf2609bfe27593eceefe278714873
- SHA1 bd1eba818419e820b3f98b850f021621e923cbb3
- SHA512 7621ada86d7fb45ac90962293b50c32fc95b9922c009210eb18643cf0deb5b8aeb7a36b050cd642e977fe1221ca1abbc19292d8c5d1621216134309f2b64cf93
- SSDEEP 6144:JFlKgzelZNQSBQGH/CSpWqTVoAXjiU4bz:+fBQGH6SfRoAX+U4
- TLSH T1515401917DA2D8B3D041493188A6CFA1973B6D13AA65D203FB9D0F4B2FB13D49B7B241
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\RCX890A.tmp
- Size 288KB
- SHA256 d3b57bd28b887e6bd16cd95645a4f0dacb7e98f7d03fc03e1fb2c4e60f6be4f3
- MD5 c19464d5f1dc21d96ef00504c3713d6c
- SHA1 3dc8ca3cd00cb2469320ad38b4d865cd664b9fb2
- SHA512 341e8cd8f34f63ef74800ee2b1f7785c7443c5e0f6ff8e75372dee69cbfcc265f490ebaa9bdc88365638cd84108042c38c998f7d8ef7022e32f2f421395983dd
- SSDEEP 6144:VFlKgzelZNQSBQGH/CSpWqTsoAXjiU4bz:yfBQGH6SfooAX+U4
- TLSH T1E25401917DA2D8B3C0419A3188A6CBA197376D139A65D203FBAD1F4B2F713D49B7B301
- MD5 SHA1 SHA512 SSDEEP TLSH