Analysis
- max time kernel
150s - max time network
138s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 04:20
Behavioral task
behavioral1
Sample
2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe
- Size 288KB
- Sample260810-ex9e4svycx
- SHA256 feed6297770dec91eb9d85f6dd14aa82697d49b1df9bc94b422723bd806213be
- MD5 97166650563fc4a8cca8b9fd120c3349
- SHA1 285c203370c83c627a2c28bed11af57385508d64
- SHA512 ee4c6e52c99cb95dcd7f2bc98d722c62cbe1e6e2361c40bd584aeeea0ce076bc445438b3d52f483cab27c7454ad08d6f16b6d4f6326a1d97e3550aaa4534c534
- SSDEEP 6144:3FlKgzelZNQSBQGH/CSpWqT9oAXjiU4bzV:ofBQGH6SfBoAX+U4l
- TLSH T16454F1917AA2D8B3D4429A314CA68F6197377D139A65D203B7AD1F4B2F713D09B3B302
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000c00000001c689-6.dat family_cosmu behavioral2/files/0x000c00000001c694-81.dat family_cosmu behavioral2/files/0x000500000001895f-192.dat family_cosmu behavioral2/files/0x000300000001b8c2-249.dat family_cosmu - Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\I: 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\J: 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\K: 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\M: 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\N: 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\D: 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\G: 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\L: 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\O: 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\RCX4C9E.tmp 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX4B4C.tmp 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.cab 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX4BF8.tmp 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX49B3.tmp 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX4CC0.tmp 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCX4A17.tmp 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iexplore.cab 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCX4CF1.tmp 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX4B17.tmp 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX4B6F.tmp 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.cab 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.cab 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX4BE7.tmp 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.cab 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ieinstal.cab 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.cab 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX4C39.tmp 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX4B16.tmp 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX4B18.tmp 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ExtExport.cab 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ieinstal.exe 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX49D4.tmp 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX4B3B.tmp 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.cab 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.cab 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX49C3.tmp 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX4CD1.tmp 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7z.exe 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7zFM.cab 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\dotnet.exe 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.cab 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX4B80.tmp 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.cab 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX4C38.tmp 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7zFM.cab 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.cab 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.cab 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.cab 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ielowutil.cab 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX4C6C.tmp 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX4B06.tmp 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iediagcmd.cab 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX4C5B.tmp 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX4951.tmp 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX4B5F.tmp 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_97166650563fc4a8cca8b9fd120c3349_elex_rhadamanthys_smoke-loader.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4444
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 334KB
- SHA256 e7b9bad646aec6757bd8b8f55abe87409ccee0214c9b9b8f03420bd56821367b
- MD5 243154efe8f57ccb3c17ee0adde6a92a
- SHA1 ddf46af0a42cae5c09799277c20383afc1f761f4
- SHA512 25ca41199614f318a07abed1e735b04d93373f79dd76295f9e3769494b4e60ffc3271e9a8a8da3d81c6b1827d733223734bda9a99a9033354969e2f7f0eaeb89
- SSDEEP 6144:kFlKgzelZNQSBQGH/CSpWqTvoAXjiU4bz:DfBQGH6SfboAX+U4
- TLSH T14A7401817DA3D8B3D041493188A6CBA1973B6D13AA65D203FB9D0F4B2FB13D49B7A351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\RCX4B17.tmp
- Size 288KB
- SHA256 790fe032fef5a73fb3856094bda80a5b7f4cf12afbe35904ff1e3a6779616f31
- MD5 0c8766b6eb5a8137d302ca043f25166e
- SHA1 fa5ba676b033f8d41fb26d27ea5d02b443b588f2
- SHA512 d6aafe6cede8470d87172742e0ba179a6ca47e3abb43c1075e5ff2a735b9b4eec18ba8f91dd0e410c9de665f02e5b5532132f79e798376261bbe4e72b80404c5
- SSDEEP 6144:AFlKgzelZNQSBQGH/CSpWqTVoAXjiU4bz:3fBQGH6SfRoAX+U4
- TLSH T1405401917DA2D8B3D041493188A6CFA1973B6D13AA65D203FB9D0F4B2FB13D49B7B241
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\RCX4C4B.tmp
- Size 288KB
- SHA256 2dc8512af0c8e4e3cce594c7947ff54f33420b10c2864c30317eaa9d2a4c1aae
- MD5 b3f91b0258c25914e455993a400107d9
- SHA1 e40f20e4ce741857cba58611b9a78d29dc90c361
- SHA512 a0081c4e92b42d05e3c3e8cbeaa1a3ef1ef289b01684304b25477e741ec1a7348f7db03027a0aa559f42aec2f81f9dbd324cd0374626d6f6b3d39b1a36371c7a
- SSDEEP 6144:cFlKgzelZNQSBQGH/CSpWqTsoAXjiU4bz:7fBQGH6SfooAX+U4
- TLSH T1785401917DA2D8B3C0419A3188A6CBA197376D139A65D203FBAD1F4B2F713D49B7B301
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe
- Size 358KB
- SHA256 60fb45040b512b185995bd1eb004a30c6041b60e717140c6660f6a08da6df745
- MD5 b44666c7344045546ea7e02bd28ca2bc
- SHA1 eeac5785aca7adde0329040dbb2de3f21a9e9872
- SHA512 9909f03bbbd64c3745324e958febad8501010a340bcd1c6e49e3b983bec7eae35546681d8889b287d55366d3b7f1a8d0a85fb49001b762337399d5e2af0171ce
- SSDEEP 6144:ZFlKgzelZNQSBQGH/CSpWqTnUjD5yoAXjiU4bz:ufBQGH6SfzUjD5yoAX+U4
- TLSH T14474F1417EA2D8F2D44146315C67CF719737BC279AA4D203B7A93B4BAE713909B3B205
- MD5 SHA1 SHA512 SSDEEP TLSH