Analysis
- max time kernel
148s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/08/2026, 05:41
Behavioral task
behavioral1
Sample
2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe
- Size 1.5MB
- Sample260805-gdfd2awvbt
- SHA256 7c2b9a9f34b3760456881562bb839c8a2bde2c380eceefda2a3b12b8645ef5e9
- MD5 98e5cebd55d98d7dbf8470e601907dde
- SHA1 7719af2d019d97def43502a9fb5689f3e8dbc538
- SHA512 bc5f3c2ce16579d2c8a81c8f3be8941658389b4c241eac57495a5b413f3ee6dd78f6b512398f8c401185d775f795f515eff6229eefedccd7df7d2d8913f28db8
- SSDEEP 6144:4FlKgzelZNQSBQGH/CSpWqTPueF/mNyBXoAXjiU4bz:PfBQGH6SfKCBXoAX+U4
- TLSH T16B65CFB27B92C66BD4E7C23DB4458557A7F29B024D139263A7A0EF3DCA392814DDCC42
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Cosmu payload 5 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000e00000001c582-6.dat family_cosmu behavioral2/files/0x000d00000001c58e-81.dat family_cosmu behavioral2/files/0x000d00000001c59b-96.dat family_cosmu behavioral2/files/0x000f00000001c58b-108.dat family_cosmu behavioral2/files/0x00050000000188c7-192.dat family_cosmu - Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\G: 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\N: 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\D: 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\H: 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\I: 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\J: 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\K: 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\L: 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\M: 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCXA758.tmp 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCXA759.tmp 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.cab 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCXA2D7.tmp 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXA40B.tmp 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCXA252.tmp 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCXA294.tmp 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXA3E6.tmp 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXA44B.tmp 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCXA704.tmp 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCXA2C5.tmp 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXA3F9.tmp 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCXA63F.tmp 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ExtExport.exe 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ieinstal.cab 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.cab 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCXA76A.tmp 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCXA2D6.tmp 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCXA2F8.tmp 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXA3F8.tmp 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXA49C.tmp 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXA49F.tmp 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\crashreporter.cab 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.cab 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.cab 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCXA541.tmp 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCXA571.tmp 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.cab 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.cab 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCXA6E3.tmp 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCXA282.tmp 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.cab 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.cab 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCXA76B.tmp 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCXA283.tmp 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7z.exe 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCXA561.tmp 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.cab 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.cab 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ielowutil.exe 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.cab 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\dotnet.exe 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-05_98e5cebd55d98d7dbf8470e601907dde_elex_rhadamanthys_smoke-loader.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4484
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 329KB
- SHA256 2ce6f6fc166269b16d6df152240f3e7d9b760493477410b9f57d2245ce45a8d0
- MD5 2fc050807123fdee2da8563bfcf17f76
- SHA1 a5714030cc18c26d11d93ae2cdc3014d2bf2f848
- SHA512 e1c8861a36adf652598fb27b760910bf28c958701092a885f45c4a704a7da27f1925220639be79ef4981ab482b745c421c8dceb973ed1bd06cf73fc114be5de5
- SSDEEP 6144:8FlKgzelZNQSBQGH/CSpWqTyoAXjiU4bz:bfBQGH6SfeoAX+U4
- TLSH T14574F1457D93C4B3E0414D31C9E68AE14B7E6C037AA6E11BFF5D0B4B1EB13884BA66B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\RCXA40A.tmp
- Size 284KB
- SHA256 d65b4965c85b399d54d46bc0d9e44106dc358bcceceebd1990b9dfe93df236de
- MD5 fbf86a667e155205f821b4abf9076b23
- SHA1 b9d488de1bcc945f0f6df28f0502c6c9462c4ebd
- SHA512 33ac1d4446ea6bcaa60f63d8dd06d347e78d8fd11438a049e0a7229c029058a51179e658efe38fecd97152d6540d9a25b058812d89409f34e4594ddc85e56c81
- SSDEEP 6144:oFlKgzelZNQSBQGH/CSpWqTRoAXjiU4bz:ffBQGH6SfdoAX+U4
- TLSH T13654F1457D93C4B3D0414D31C9E68BE14B7E6C037AA6E11BFB5D0B4B1EB13884BAA6B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome.exe
- Size 308KB
- SHA256 3ee71443d4743c2c9a9da22beedae112b546be05e2189da46364df015fdd2b68
- MD5 7eaccb1700d56097e3a942b66d13c35c
- SHA1 0d7d7b6df2116ee799f27d8384d9e48a46fb566b
- SHA512 14a3f7bf4c02f9d19957614d85388ab9c642a0e5f96dec9eae447da3acaaf257318094e5c29f9d11d678c569e44fc8af65f9d83dc7cc1bad18a8bcbf9be32c57
- SSDEEP 6144:wFlKgzelZNQSBQGH/CSpWqTvoAXjiU4bz:HfBQGH6SfjoAX+U4
- TLSH T12264BF42B65BCCF3E1430530C85AC2B01B3A6D1FB667D52BB7592B073DE138506AFA66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome.exe
- Size 1.5MB
- SHA256 386aa6d5a05cfb1c17ffab9c322bf965a9032cb3d6bdab9a821acf7c8b554d1d
- MD5 8204d4cb64f5b3f6c482738c92cac4ca
- SHA1 77212aeceed2f6e0c2358023ceddd1c38d058077
- SHA512 a72ac490b7c3633c861d5d2c8374a0f44433e3e94f415cf1269818c3ab88a38ee0456daf33b177d0b4ee0b7f44c56d20f9eb71fc33bc33063c3ebf1b51954638
- SSDEEP 6144:iFlKgzelZNQSBQGH/CSpWqTmaXKv7VoAXjiU4bz:lfBQGH6SfCTVoAX+U4
- TLSH T1ED65BF52B656DEB3E242C430D85AC2B0473ABC1FA227853777593A472FB13C807AF656
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\RCXA6E3.tmp
- Size 284KB
- SHA256 9f1cfa81c9c6872adeee3eafe781ffe43a614124fb467a94efcd33ab26516d92
- MD5 957c0db22becdd5506b36d60095899d4
- SHA1 b21077e9ac57c30a470067808a42b032660c70de
- SHA512 386e4851e5479ea7991395aaa71f49dfc124fb9637fbb237a03b46d1e729e630a37924209e236562be0a1dc32ce592c4006be28586c7f084e597725303550240
- SSDEEP 6144:UFlKgzelZNQSBQGH/CSpWqTEoAXjiU4bz:TfBQGH6SfwoAX+U4
- TLSH T1FD5402457D93C4B3D0414D3188E68BE19B7F6C137AA6E11BFB5D0B4B1EB13844BAA261
- MD5 SHA1 SHA512 SSDEEP TLSH