Analysis
- max time kernel
148s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 19:42
Behavioral task
behavioral1
Sample
2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe
- Size 292KB
- Sample260804-ye478awyex
- SHA256 cb05e11c417781951a6c4fe110df9b8e6bb042dacdb96f9e5478f05a4ee6664a
- MD5 7625fd8665b66456134994642d0c7a4a
- SHA1 819bcae5e466b8e6a1315de63bc2a6e3c0e5129e
- SHA512 e4a0fbb676e703eed3dc060add22006b049da987cdeb12a860c9082f7200b0d13c98eb410c119211a221f414a92f13474afba3edb8fee6334ab933d9bad36aa0
- SSDEEP 6144:XFlKgzelZNQSBQGH/CSpWqTSoAXjiU4bz1:IfBQGH6SfOoAX+U4F
- TLSH T13F54F2453D53D873E041493189E6CAE14B7F6C1376A2E21BFB981F4B1EF13885AAA271
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Cosmu payload 3 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x001200000001c450-6.dat family_cosmu behavioral2/files/0x000e00000001c514-81.dat family_cosmu behavioral2/files/0x000500000001897f-192.dat family_cosmu - Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\I: 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\L: 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\N: 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\O: 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\J: 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\K: 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\M: 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\D: 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\G: 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\RCXF959.tmp 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCXFACB.tmp 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXF958.tmp 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXF97C.tmp 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ielowutil.cab 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.cab 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7z.cab 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCXF78D.tmp 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCXF7E0.tmp 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iexplore.cab 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.cab 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7zFM.cab 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\RCXFAAA.tmp 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCXFB0F.tmp 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.cab 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCXF99D.tmp 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.cab 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCXF9E2.tmp 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.cab 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.cab 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCXFACA.tmp 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.cab 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCXFAED.tmp 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCXF79F.tmp 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ieinstal.cab 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ieinstal.exe 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.cab 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7zFM.cab 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXF912.tmp 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ielowutil.exe 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCXF802.tmp 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome.cab 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\readme.1xt 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\dotnet.cab 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXF924.tmp 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCXF76C.tmp 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCXF9AF.tmp 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCXF9BF.tmp 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iexplore.exe 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCXFA54.tmp 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.cab 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_7625fd8665b66456134994642d0c7a4a_elex_rhadamanthys_smoke-loader.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4624
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 325KB
- SHA256 d9cab5bc7a85851e63d0cf11916502318e2da0e2ce7921bceb7bb315e38f13b8
- MD5 aaeae39c11f424bb9a2fe0bf499398bf
- SHA1 16f451563e9eee2a41f4258e4b6895b1e79b76d4
- SHA512 e02083cf82c6c25a7e08254f960ebadc7786223c464f56dec89879cce2786e4cdf85b9a464e53c1d0d19e08918a64ae448178e69bc5707a9a1e525d6f359dba4
- SSDEEP 6144:AFlKgzelZNQSBQGH/CSpWqTyoAXjiU4bz:3fBQGH6SfeoAX+U4
- TLSH T18164F1457D93C4B3E0414D31C9E68AE14B7E6C037AA6E11BFF5D0B4B1EB13884BA66B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\RCXF924.tmp
- Size 284KB
- SHA256 d021ed3196608b06f2219260db2084fdbff318f745f29b9bcbef401daf50aa87
- MD5 fd826498842cf09d27b7abb7304c72a4
- SHA1 41e52f4ba655c66f54e86fe8e367cc4c9b36053a
- SHA512 92e7fa6f4bb780f9fd4bb72466fb06dc714810c96ea6a142da8a82ad7d5f8c7d748f293de749ba524ab640e98577076fc62ed24908a2bf77f8e8082f6c1ad2f1
- SSDEEP 6144:sFlKgzelZNQSBQGH/CSpWqTRoAXjiU4bz:rfBQGH6SfdoAX+U4
- TLSH T1F554F1457D93C4B3D0414D31C9E68BE14B7E6C037AA6E11BFB5D0B4B1EB13884BAA6B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\RCXFA67.tmp
- Size 284KB
- SHA256 cc5b4c68ef2ee3b922f3b5a76b3286e5e713a44bd480c7c3ad129a17740fc504
- MD5 d2c3b4e09d27acd2fee14b405d203d95
- SHA1 c227a614cca1b135ccb44cc8a50a96e5634e9285
- SHA512 30892499b3b99a75ac4b2c00103a2fd487aa94999e0c10fcecf9099333237ecfdc48a234771d320aa9411af844f248ab14c8f0974b5e5e444034c15d411168a1
- SSDEEP 6144:YFlKgzelZNQSBQGH/CSpWqTEoAXjiU4bz:vfBQGH6SfwoAX+U4
- TLSH T1D55402457D93C4B3D0414D3188E68BE19B7F6C137AA6E11BFB5D0B4B1EB13884BAA261
- MD5 SHA1 SHA512 SSDEEP TLSH