Analysis
- max time kernel
148s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 18:38
Behavioral task
behavioral1
Sample
2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe
- Size 1.5MB
- Sample260804-w952wsfc26
- SHA256 e0f7094574357d6a666c5b17929f9380f0889525f6962c2a31af71eb04f71120
- MD5 b62672e30f0f405737c0ec22ce59d178
- SHA1 8863754f088f73df554731e7599e15e92e8d2f07
- SHA512 7b6367c85e48693de4d0c96b2ccd2a047aa07f254f644c27ff4778431f7b5ddb776a0506296182cb6ff91bb47393408ef1dc75a8853c648f7157e94f2e4f9194
- SSDEEP 6144:SFlKgzelZNQSBQGH/CSpWqTfueF/mNyBqoAXjiU4bz:1fBQGH6SfaCBqoAX+U4
- TLSH T13B75CFB17B93856BD4E7C23CB1858593ABF69B031D539263D7A0EE3DCA392814DD8C42
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000e00000001c54d-6.dat family_cosmu behavioral2/files/0x0008000000019c61-81.dat family_cosmu behavioral2/files/0x0005000000018983-188.dat family_cosmu behavioral2/files/0x0005000000018985-192.dat family_cosmu - Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\J: 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\O: 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\D: 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\K: 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\L: 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\M: 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\N: 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\G: 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\H: 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\7z.exe 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX41A3.tmp 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCX426C.tmp 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX4396.tmp 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.cab 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX44DF.tmp 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX46BA.tmp 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCX46DB.tmp 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX41B3.tmp 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX4419.tmp 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX41C5.tmp 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\dotnet.exe 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCX424C.tmp 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.cab 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.cab 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.cab 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX44BD.tmp 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.cab 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX446C.tmp 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.cab 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX46CA.tmp 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7z.cab 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX4395.tmp 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.cab 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCX421A.tmp 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX449C.tmp 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.cab 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iediagcmd.cab 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.cab 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX44CE.tmp 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX41C7.tmp 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX445A.tmp 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome.cab 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX4372.tmp 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iexplore.exe 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX449D.tmp 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX4657.tmp 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.cab 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7zFM.exe 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.cab 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ieinstal.cab 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX4699.tmp 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7zFM.cab 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_b62672e30f0f405737c0ec22ce59d178_elex_rhadamanthys_smoke-loader.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3140
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 334KB
- SHA256 cb96c4f6cc7e0196909b59ae600eccf371295905ce85a4655eff1e277e1cc95b
- MD5 b9b845c3e6f6a644f6761c69fd87863e
- SHA1 207b2f87e49b60d06bb423b97a0a1ee048d03d2b
- SHA512 3e416b849fa110f8e7b2cfc6542650693d0fe7237762e6278cb36dc2459283c070922e37527699d69f62b10c08a08c93a7443d9f4e76f1b6fc9592262364f962
- SSDEEP 6144:5FlKgzelZNQSBQGH/CSpWqTvoAXjiU4bz:OfBQGH6SfboAX+U4
- TLSH T15D7401817DA3D8B3D041493188A6CBA1973B6D13AA65D203FB9D0F4B2FB13D49B7A351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\RCX433C.tmp
- Size 288KB
- SHA256 bdd996956ef5a902cf1116e53d819712f06959720c1a55add1005d9557fce4f3
- MD5 6ee1c2ee60f5bd12df8335edcda5135c
- SHA1 3ed57f829505985b0ccc916a5bbc34fbe973b0a5
- SHA512 f2ae2a53df84e0b0ad580bf404b775c31006923646da0ea5c9c8bf657d84990a6b823d54653ef3dc31ccfcb7e21cdc3e89bd9e401cfe111fe47220c277bddef2
- SSDEEP 6144:9FlKgzelZNQSBQGH/CSpWqTVoAXjiU4bz:afBQGH6SfRoAX+U4
- TLSH T11B5401917DA2D8B3D041493188A6CFA1973B6D13AA65D203FB9D0F4B2FB13D49B7B241
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\RCX44BE.tmp
- Size 288KB
- SHA256 19fca36d6c21577da4dbb8a6014fd187282a46208efaaaec63183c857c51b9e6
- MD5 13384066d90a56d3b4c3ea4b18298794
- SHA1 ae139ccbd28614f0efbb3fe522d81466371613fe
- SHA512 d6d001ee691d9458a7421fda9bc1cd8fa5c60587415cc7a61699d782ae44dd455e690826d04028dc4e141c6e37425ed66c09d7dc0bfa7dba4e59d403ae0c81c4
- SSDEEP 6144:pFlKgzelZNQSBQGH/CSpWqTsoAXjiU4bz:efBQGH6SfooAX+U4
- TLSH T16A5401917DA2D8B3C0419A3188A6CBA197376D139A65D203FBAD1F4B2F713D49B7B301
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 288KB
- SHA256 b0b033ed3d8ca1184f1bd6f19f7421e68f77d9420225e2012d106016ec31315d
- MD5 f9fb883912ec265e9079c2f9fc7c129e
- SHA1 3ec6330d96ea70adf6c683fd2c8fc811a58fb4dd
- SHA512 ec5664c20d8e84055c99d12b91dc731b9b01547ab4fac40cf4054889ffefe75bcc84a74d65f9e8158713cab0955903a60fbdf894420fd2a35981ea41a1f286c8
- SSDEEP 6144:pFlKgzelZNQSBQGH/CSpWqTaoAXjiU4bzF:efBQGH6Sf2oAX+U41
- TLSH T1A35401917DA2D8B3C0419A318CA68BA197376D139A65D203FBAD1F4B2F713D49B7B301
- MD5 SHA1 SHA512 SSDEEP TLSH