Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/08/2026, 19:57
Behavioral task
behavioral1
Sample
2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe
- Size 1.5MB
- Sample260813-ypd4saxejc
- SHA256 1dea7bd260d9df0c7ce89b72e9822d60913862cfd6c28b78a4f4c92ed3cdfb20
- MD5 d452cc336ad0359b0669657febced924
- SHA1 8a1bca650e2247f63bba8cf832a1f5e57b0a8670
- SHA512 5e75c2090c5ffefc1a7e618956c956ec6ee3801a98bdbbcc9fa524f2d092be75371da5015072916607236c5ba65f434de453ebcf0a869dc3bdd3a73f2556aef9
- SSDEEP 6144:CFlKgzelZNQSBQGH/CSpWqTPueF/mNyBXoAXjiU4bz:FfBQGH6SfKCBXoAX+U4
- TLSH T18565CFB27B92C66BD4E7C23DB4458553A7F29B024D13926397A0EF3DCA392814DDCC42
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000e00000001c526-6.dat family_cosmu behavioral2/files/0x0005000000017616-65.dat family_cosmu behavioral2/files/0x000d00000001c533-81.dat family_cosmu behavioral2/files/0x00050000000188cd-192.dat family_cosmu - Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\J: 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\L: 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\M: 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\G: 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\I: 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\K: 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\N: 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\O: 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\D: 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Internet Explorer\iexplore.cab 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7zFM.cab 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\dotnet.exe 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX168.tmp 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.cab 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCX223.tmp 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7z.exe 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX90.tmp 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCXF6.tmp 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ielowutil.cab 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\crashreporter.cab 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.cab 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.cab 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7z.cab 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX19.tmp 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX200.tmp 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCXFE13.tmp 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX4E.tmp 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCXB4.tmp 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXFFF6.tmp 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX7F.tmp 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX91.tmp 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.cab 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCXFF09.tmp 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCXD4.tmp 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.cab 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.cab 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX127.tmp 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iexplore.exe 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX201.tmp 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCX222.tmp 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCXFE43.tmp 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCXFEA7.tmp 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCXFEA8.tmp 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX4D.tmp 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCXA2.tmp 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCXB3.tmp 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX139.tmp 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.cab 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-13_d452cc336ad0359b0669657febced924_elex_rhadamanthys_smoke-loader.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4172
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 329KB
- SHA256 6c0687eafc743e2f7c7f731183fefa28e2ecbced6d0aa2e83606f1ca9c2867fa
- MD5 38f991308331ecc8ea94d8df9e50024e
- SHA1 474ed7ab41c8313f03367e296518e4fc039e736c
- SHA512 98479b5524d1ddea14813cf2b6d1de9d46663552b2c8db8017534f5fc96537f02e0d3c64b2461b506df081ddcb3fe2f162729ca1a4edac466e1dd710838271a9
- SSDEEP 6144:jFlKgzelZNQSBQGH/CSpWqTyoAXjiU4bz:sfBQGH6SfeoAX+U4
- TLSH T1E774F1457D93C4B3E0414D31C9E68AE14B7E6C037AA6E11BFF5D0B4B1EB13884BA66B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\RCX19.tmp
- Size 284KB
- SHA256 ef59c87dae63d71833b88dd0d604c427ddf119a8004100eab6d64bbcbcbae8b9
- MD5 10635a8af8d8bc89b1f3da57460573b2
- SHA1 9e3add0e12a137d84e76025ea8f291b9859273fe
- SHA512 cf25436b32f7f5fd869d17557ce0dab3c329674957b3cf218b93470b27c8f32ab4fd2f1ffb1fd61960fff88c28aeaa1c37c21a384a4344c8c2d925662987591a
- SSDEEP 6144:/FlKgzelZNQSBQGH/CSpWqTRoAXjiU4bz:wfBQGH6SfdoAX+U4
- TLSH T15C54F1457D93C4B3D0414D31C9E68BE14B7E6C037AA6E11BFB5D0B4B1EB13884BAA6B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\RCX18B.tmp
- Size 284KB
- SHA256 d62317bcdae9cf2d07e4d2e8b96b71fb5a16a432aafc99c41c84a480e01fc41e
- MD5 fe044cdb9135a8e85b5d724716676f83
- SHA1 22b0a4916329e16805a83ddb46728a00c525a7de
- SHA512 3eb44f24cb8ac2ed11bd2011dcd5843e9d730d8959b197a852964b6d4972dc639e7ecf7f6a6cb6fe13aad6bd9240a6e96c87f458e172191f064cb59e485f96e8
- SSDEEP 6144:TFlKgzelZNQSBQGH/CSpWqTEoAXjiU4bz:8fBQGH6SfwoAX+U4
- TLSH T1F75402457D93C4B3D0414D3188E68BE19B7F6C137AA6E11BFB5D0B4B1EB13844BAA361
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
- Size 284KB
- SHA256 3e7d3dd272cceb383a050303282b1336bf8899b547ff5e4d477cd9df170ec8ac
- MD5 5470436310ddc26ba54d490596b52496
- SHA1 4dedf57f726a1d24a16490cf4c0e00e486cc3cdb
- SHA512 dd4c4e019327422b532884f34e313a78d07d228cac13d50d2f79e29ed5d474f4f428a79ed8b6d85cb122699dcb0226e28d5fb8bc512116717b9a886247d6adec
- SSDEEP 6144:TFlKgzelZNQSBQGH/CSpWqTxoAXjiU4bz1:8fBQGH6SfVoAX+U4F
- TLSH T1A15402457DA3C4B3D0414D3188E68BE19B7F6C137AA6E11BFB9D0B4B1EB13844B6A361
- MD5 SHA1 SHA512 SSDEEP TLSH