Analysis
- max time kernel
148s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 04:15
Behavioral task
behavioral1
Sample
2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe
- Size 284KB
- Sample260810-evmtbsaq7s
- SHA256 3723b2234fc7d94a4d08292504b08502e634c5f53944d165c3249a08e6bee62c
- MD5 9dfcc0e4c0960b059e3ef0b098ff4320
- SHA1 3debcceea6b7de7e65cd29d6d52ce032ba75f68d
- SHA512 7f007b2addfa30af4ccf1fbc16684fe87c81509d5b9386a22a8e05a386a5615740ff92386b6dc7f4b4e13ac61100d075e7f90c60ba7b306cdd5ce36ee4e4218a
- SSDEEP 6144:jFlKgzelZNQSBQGH/CSpWqTwoAXjiU4bzd:sfBQGH6Sf0oAX+U4t
- TLSH T1F95402457D93C4B3D0414D3188E68BE18B7F6C137AA6E11BFB9D0B4B1EB13844BAA361
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000e00000001c4d6-6.dat family_cosmu behavioral2/files/0x000d00000001c4e3-81.dat family_cosmu behavioral2/files/0x000400000001bb55-92.dat family_cosmu behavioral2/files/0x00050000000188c7-192.dat family_cosmu - Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\N: 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\D: 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\G: 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\H: 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\J: 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\K: 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\L: 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\O: 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\I: 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.cab 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX28D8.tmp 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCX253C.tmp 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.cab 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.cab 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX2509.tmp 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX251B.tmp 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX27C3.tmp 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iediagcmd.cab 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.cab 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCX263A.tmp 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.cab 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.cab 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX28D9.tmp 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX2715.tmp 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX274B.tmp 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX275D.tmp 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iexplore.cab 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.cab 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCX253D.tmp 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX275C.tmp 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX24A5.tmp 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7zFM.exe 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX250A.tmp 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCX253E.tmp 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.cab 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCX2972.tmp 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.cab 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX2897.tmp 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\dotnet.exe 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.cab 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX2950.tmp 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX2728.tmp 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX275E.tmp 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX2863.tmp 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.cab 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX28B7.tmp 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX27B0.tmp 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.cab 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX28F9.tmp 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.cab 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX293D.tmp 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX24C7.tmp 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCX2960.tmp 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\readme.1xt 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7z.cab 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX251A.tmp 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX2864.tmp 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.cab 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.cab 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_9dfcc0e4c0960b059e3ef0b098ff4320_elex_rhadamanthys_smoke-loader.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:992
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 329KB
- SHA256 0eb1a7222f2a8437be451ef63b28fb99b2a64e6d54506f903a314579aa14e60a
- MD5 a7f4ece4aecee041f5e97a74b2c29b48
- SHA1 93718916900238fc650c8a76a4de25e2691bfb74
- SHA512 cdcc5dc08b2d3156db1ef01923d9b3eed6091927a42b2150fec9c5e6ddbfa48543c075c105b6d8e76b7463e49d171c1bf91fd9399f4b5679c792fcb8575266b6
- SSDEEP 6144:KFlKgzelZNQSBQGH/CSpWqTyoAXjiU4bz:NfBQGH6SfeoAX+U4
- TLSH T14374F1457D93C4B3E0414D31C9E68AE14B7E6C037AA6E11BFF5D0B4B1EB13884BA66B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\RCX2739.tmp
- Size 284KB
- SHA256 3b1e554091e15aab682d22e7c03fcec823302eb20086d423afd4731f7c72e5b3
- MD5 99a37a2eb8e9e54097d4b03da795597c
- SHA1 2e5abe4befa0e74b59e0a1a3915cc07122b37e54
- SHA512 8bcf6ceb232f2bfa1b3e89cca09b276f4d77903739bf47f091b183c5881a4779bad090bc95ec44c357f59f1f834b8292899f3321b07b5a1f577f3fb5d82d1071
- SSDEEP 6144:mFlKgzelZNQSBQGH/CSpWqTRoAXjiU4bz:BfBQGH6SfdoAX+U4
- TLSH T1EC54F1457D93C4B3D0414D31C9E68BE14B7E6C037AA6E11BFB5D0B4B1EB13884BAA6B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome.exe
- Size 1.5MB
- SHA256 5e07bedce7441a06ebab0932c6a8dcb148ba33760c14cddd991fa979be1a30b1
- MD5 a5e374f1b0267d86c5c967bd9df88b6b
- SHA1 77d340e586901b718681d6c462d861d60fc69619
- SHA512 6d92835a829837ed3906989b09799967b0df033661a74f08a68d8164e5ed933818ddcaecb56ec6d3d7a2e434b22314e2b37ab377351d0ec251b1cecaeac5e017
- SSDEEP 6144:PFlKgzelZNQSBQGH/CSpWqTYv04NIIoAXjiU4bz:gfBQGH6Sfk0XIoAX+U4
- TLSH T1A065F140BDD3D5B3D402453184A78AB04BBF6E47755BD227FBA96F4B2EF03C41A66222
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\RCX28D9.tmp
- Size 284KB
- SHA256 9659a17367038ad66a537cdcd4335e28a313d1fb1ed3b2019cca9575b8208277
- MD5 6105dc11b007e5b50a045583118b6b19
- SHA1 357103c18dea3c4df3209f6c6c0a5c2c1bc1a197
- SHA512 23c0a950d7a57ab0c2660052dc931f9bec4ede81f56e688f5dcc0ec3f46cf878e6fdca61012423a48c9efe1173d625c1945f12a0a6d2e2e98a3791db973fe895
- SSDEEP 6144:KFlKgzelZNQSBQGH/CSpWqTEoAXjiU4bz:NfBQGH6SfwoAX+U4
- TLSH T1D95402457D93C4B3D0414D3188E68BE19B7F6C137AA6E11BFB5D0B4B1EB13844BAA361
- MD5 SHA1 SHA512 SSDEEP TLSH