Overview

overview

10

Static

static

10

2026-08-07...er.exe

windows10-2004-x64

10

2026-08-07...er.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    08/08/2026, 01:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-07_78432b4a549d731eacd346618c91b357_elex_rhadamanthys_smoke-loader.exe
  • Size 1.5MB
  • Sample260808-bg1aqaah99
  • SHA256 72117a81c109138651e169e9ef75cd27cdea03cd0c0edf7e2c82b50a30197063
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarediscoverycosmuransomwarespywareworm

Malware Config

Signatures

  • Family: Cosmu

    Cosmu is a Windows worm written in C++.

    wormcosmu
  • Detects Cosmu payload 3 IoCs

    Cosmu is a worm written in C++.

  • Enumerates connected drives 3 TTPs 10 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-07_78432b4a549d731eacd346618c91b357_elex_rhadamanthys_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-07_78432b4a549d731eacd346618c91b357_elex_rhadamanthys_smoke-loader.exe"
    1⤵
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    PID:4612

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.cab
        • Path C:\Program Files\7-Zip\7z.cab
        • Size 549KB
        • SHA256 707f415d7d581edd9bce99a0429ad4629d3be0316c329e8b9ebd576f7ab50b71
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 1.5MB
        • SHA256 d8154c68e97a5b40b62fdce14984848834500b1e90513f253da149d9826110d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.cab
        • Path C:\Program Files\7-Zip\7zFM.cab
        • Size 963KB
        • SHA256 028cf2158df45889e9a565c9ce3c6648fb05c286b97f39c33317163e35d6f6be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.cab
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab
        • Size 281KB
        • SHA256 6d54694077faf07473196da7b7f1c6981c8ad6a462fcea4777a80cfc6bc5769e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RCX5833.tmp
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX5833.tmp
        • Size 284KB
        • SHA256 aaa0c4036330213bfe35c48c288edad8d204dbaf4f6c23d392a1d4d547cc4ce4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.cab
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab
        • Size 2.1MB
        • SHA256 7e0976036431640ae1d9f1c0b52bcea5dd37ef86cd3f5304dc8a96459d9483cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.cab
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.cab
        • Size 6.1MB
        • SHA256 ca434df4bbfcadf6a6610a6bbea4eb435adb91751670f63c0a6bc3207e4a89a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.cab
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab
        • Size 1.7MB
        • SHA256 415ddfcaeb5f4240359dd12ed5cc53610c27d144ce44df6013ea5f6546102080
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.cab
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.cab
        • Size 3.5MB
        • SHA256 e0004b24f9d4e74eff4e221871e5bb7233b57033f5725c5d5c67c07f0a8976ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RCX5998.tmp
        • Path C:\Program Files\Google\Chrome\Application\RCX5998.tmp
        • Size 284KB
        • SHA256 b611bcdca401e5a5ed9be33b4b33bc889e77290f3028221103fe003a1eb26988
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.cab
        • Path C:\Program Files\Google\Chrome\Application\chrome.cab
        • Size 3.1MB
        • SHA256 fdcfa390134b6d9a6bb68f9b7c452c01701e2b27fca1b9227e5b92f652df2457
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.cab
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.cab
        • Size 1.4MB
        • SHA256 79587605707bb61fde6eb92ee778b2e2a01725daac73e07f1569f9de4368f72b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.cab
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab
        • Size 23KB
        • SHA256 ea8543b0eab31dece2b50ef45a2585f4de09af35c68d9a63152944f8a831ac29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.cab
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.cab
        • Size 23KB
        • SHA256 955f386e3af5d87a46dcb2064967e34eb25a44ca3d2436e54bd5b84f4a2ab2ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.cab
        • Path C:\Program Files\Java\jre-1.8\bin\jabswitch.cab
        • Size 44KB
        • SHA256 7f1b10f0679401e5360f7e0baf903035728a631c03056b7d40dbb6ae734fecae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.cab
        • Path C:\Program Files\Java\jre-1.8\bin\java-rmi.cab
        • Size 23KB
        • SHA256 ee8ecfd717dfde63ff423f21fca560d80ec333ebfe2d55aba23fb7a1c4bffaaf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OSPPREARM.cab
        • Path C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab
        • Size 238KB
        • SHA256 ac66bafa0e7196b9f7b4a83b9625b32e83db7731418ecd0f4a8de474f7355254
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        crashreporter.cab
        • Path C:\Program Files\Mozilla Firefox\crashreporter.cab
        • Size 3.4MB
        • SHA256 180179d0b6cd38c05a5c6b42789517d8ff5e53123cef96004e27a476a069266b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        default-browser-agent.cab
        • Path C:\Program Files\Mozilla Firefox\default-browser-agent.cab
        • Size 34KB
        • SHA256 685f420616cb6ec8720f194bb9fdb45c79973f1976f2b3288f1efbf7b0fd0fde
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        helper.cab
        • Path C:\Program Files\Mozilla Firefox\uninstall\helper.cab
        • Size 1.3MB
        • SHA256 adeb96785772bef583c62e7796393cdb33489638dacce17b320704fb1844713d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.cab
        • Path C:\Program Files\dotnet\dotnet.cab
        • Size 143KB
        • SHA256 7ae20d0542a544b54730a5520a2c7b56dc9235be1a4dc1331763786a16fabed9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.cab
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab
        • Size 56KB
        • SHA256 6e25f414dd65440cd0c285990f4eef789a831fff640dadb4afdf79a5dfd95bc2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download