Analysis
- max time kernel
148s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 01:02
Behavioral task
behavioral1
Sample
2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe
- Size 284KB
- Sample260808-bdxenaxale
- SHA256 e820d1359fbcfebc5fd25ca3745c1bd088bae0d89de0647d52302c1afc9eb0fe
- MD5 855e955fa56cca727585334f95bcf270
- SHA1 faa2c0073d5b9310c1948b391a72185ad25f5b9a
- SHA512 9244884edd51e5ddbb6bfd462ecfc1a8030a0d52e3eb0ef1e92aee6e70f0cd7b5e6b68e8884b39b51e7d2989db4acd8892a23fe5b8d8d02d714314f3faa8c8f0
- SSDEEP 6144:RFlKgzelZNQSBQGH/CSpWqTLoAXjiU4bz1:GfBQGH6SfvoAX+U4F
- TLSH T1615402457D93C4B3D0414D3188E68BE14B7F6C137AA6E11BFB9D0B4B1EB13884BA6761
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Cosmu payload 3 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000c00000001c615-7.dat family_cosmu behavioral2/files/0x000400000001ba98-82.dat family_cosmu behavioral2/files/0x0007000000018975-193.dat family_cosmu - Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\M: 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\N: 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\O: 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\D: 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\G: 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\I: 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\K: 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\H: 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\J: 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe - Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Control Panel\Desktop\Wallpaper = "C:\\windows\\WallPapers.jpg" 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCXE3A2.tmp 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.cab 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCXE3E6.tmp 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.cab 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCXE0D8.tmp 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.cab 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCXE43C.tmp 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXE21C.tmp 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXE31C.tmp 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCXE3C4.tmp 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ielowutil.exe 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.cab 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCXE47F.tmp 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXE22E.tmp 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXE20A.tmp 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCXE3D5.tmp 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCXE42A.tmp 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.cab 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iexplore.exe 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCXE14C.tmp 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCXE390.tmp 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.cab 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCXE4B3.tmp 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXE240.tmp 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.cab 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCXE094.tmp 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXE209.tmp 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXE250.tmp 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXE36F.tmp 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCXE3C5.tmp 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ExtExport.exe 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCXE418.tmp 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7z.cab 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\dotnet.cab 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\crashreporter.cab 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCXE12A.tmp 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCXE12B.tmp 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ExtExport.cab 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCXE4A2.tmp 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7zFM.cab 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome.cab 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.cab 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCXE3B3.tmp 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\windows\readme.1xt 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe File created C:\windows\WallPapers.jpg 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Desktop\General 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe Set value (str) \REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Desktop\General\WallpaperSource = "C:\\windows\\WallPapers.jpg" 2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-07_855e955fa56cca727585334f95bcf270_elex_rhadamanthys_smoke-loader.exe"1⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:928
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 334KB
- SHA256 ca3781e5719a136173f914ee695f40dabd2b05f0c6c39690eff52d24640a8a03
- MD5 b2512b15f99ba3f8604a183b802014d9
- SHA1 59be589014d7ce73c95726b14d7a446af07e9309
- SHA512 cf3a2b384feae2402be4f181824cae18d5a8ae6829422a1d0529eaa4732f29613170cf303eed383333c13a755e8a9b53538228fb6a104ca4202e5a25e9fd60d1
- SSDEEP 6144:wFlKgzelZNQSBQGH/CSpWqTyoAXjiU4bz:HfBQGH6SfeoAX+U4
- TLSH T1AE74F1457D93C4B3E0414D31C9E68AE14B7E6C037AA6E11BFF5D0B4B1EB13884BA66B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\RCXE21C.tmp
- Size 284KB
- SHA256 95e7c5a6bc96e85eea0dd7313bb472f2931b4380f392957c84f013119aaa7654
- MD5 cf90d3ac78ba3777408c2d160dcb2677
- SHA1 47d3d3f21faef5e56f56deaaf96808ee4b21e068
- SHA512 6808917e53c36f2be855c4d6f195c95a215d081111a4242b2bbc53f8160b4b487abd337d8ec19c7b1dffb489ad5afa6c9c201095cb2a8ad5f98d00dea4fdedf5
- SSDEEP 6144:cFlKgzelZNQSBQGH/CSpWqTRoAXjiU4bz:7fBQGH6SfdoAX+U4
- TLSH T1D454F1457D93C4B3D0414D31C9E68BE14B7E6C037AA6E11BFB5D0B4B1EB13884BAA6B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\RCXE42A.tmp
- Size 284KB
- SHA256 806c2b1f8ad7d19427c4ef38bc73a2fe291ebd2ae46bf5a4f8762364b8e2bfa0
- MD5 e1651bda1c175128de9c47b196ca7b58
- SHA1 6174c25bc4043267d70c3ceb423983813d6b0807
- SHA512 1af08f2984ea2bf72b3614029ef7f7b28a4138454f53d933c9fba27ebe40adaa6d1869744836d42bd1ff33323c069869353a33cc64a147a12fc4e4ed7c1628bb
- SSDEEP 6144:IFlKgzelZNQSBQGH/CSpWqTEoAXjiU4bz:/fBQGH6SfwoAX+U4
- TLSH T12D5402457D93C4B3D0414D3188E68BE19B7F6C137AA6E11BFB5D0B4B1EB13844BAA261
- MD5 SHA1 SHA512 SSDEEP TLSH