Analysis
- max time kernel
148s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/08/2026, 09:47
Behavioral task
behavioral1
Sample
2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe
- Size 337KB
- Sample260814-lsbfvazhnd
- SHA256 f207ee053631edcaabc1913e591870dcc109a4d88f5c7d25d37f6d841cd50445
- MD5 b0dd44498ed39795910d40c92c9e6942
- SHA1 576a04e2f470b038b73a1fe2f786986261eb4634
- SHA512 df6362fa899360a51267c9f390d559ef1bfa8a9c8244eb023ed67bd59176d4a2a62d5b0a62a40f76f9ae5adc3c352b48f0f4a7db9926d7b219187318261267ee
- SSDEEP 3072:yCOPi3tG24aqTBrgmQ+Pkvb0AXj5iNyPpT4DG2k:AFEqTKmQhoAXjiU4Dz
- TLSH T1B274D04279B1D4B3D0510671886B8B61B7377C12AA69C603BB9D1F8F2FB17909B3634E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000e00000001c44d-6.dat family_cosmu behavioral2/files/0x000d00000001c452-23.dat family_cosmu behavioral2/files/0x000d00000001c459-81.dat family_cosmu behavioral2/files/0x00050000000188c7-192.dat family_cosmu - Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\H: 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\J: 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\K: 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\M: 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\D: 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\I: 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\L: 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\N: 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\O: 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Internet Explorer\ielowutil.exe 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.cab 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCXE0E.tmp 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXF44.tmp 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7z.cab 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCXD36.tmp 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.cab 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.cab 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX1081.tmp 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCXDBB.tmp 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXF21.tmp 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCXF88.tmp 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX104D.tmp 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX105F.tmp 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX12B7.tmp 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCXD78.tmp 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCXDDB.tmp 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXF0E.tmp 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome.cab 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXEFA.tmp 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCXFA9.tmp 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.cab 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXEEA.tmp 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ieinstal.cab 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7z.cab 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\dotnet.cab 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ielowutil.cab 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCX12DC.tmp 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iediagcmd.cab 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCXD9A.tmp 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXF33.tmp 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCXF87.tmp 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iexplore.cab 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCXDBA.tmp 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCXDED.tmp 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCXF86.tmp 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.cab 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.cab 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCXDEC.tmp 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXEFB.tmp 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX101C.tmp 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-14_b0dd44498ed39795910d40c92c9e6942_elex_rhadamanthys_smoke-loader.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1196
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 328KB
- SHA256 6093bc1cbbfc809344fd2cb5cf4f50dbf9ba293fad3f7f4906f4ca140c589770
- MD5 d527f084e1aaf75379e7efb5a7fdfb73
- SHA1 6c40c511fea1b69e7d3dce41fa5a90a12c5d76a5
- SHA512 e388e2ea0c6ec0637c295d69a62e00c3748f6b97e200d3e81fd353918bb937ca301e5fb208aec2508fb79f9de4e1a0bf241a0f2bc2c393ae70b02a776ad3860c
- SSDEEP 3072:2COPi3tG24aqTBvkvb0AXj5iNyPpT4DG2k:0FEqTyoAXjiU4Dz
- TLSH T17864CF553C53C473E0410931C9D68BD18BBE6C037AABD12BFF990B4B1EE129497B66B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 336KB
- SHA256 f205bbf7794ddf1bcf35bb0b17670011372045e43425cda2529790a8592d3f69
- MD5 7e261d18e002dada4f340cca635b0972
- SHA1 ec4be333f5d7a4f74f53a3ebb8c7642b640bb20a
- SHA512 6bcb8d8c8bc99f575ea1de70e55787f396485f8a005596ace2960dc5c2f6fb063854ae3bdf2144f72d807b958691ad20cb08fc8d2df73d21004563712e80be78
- SSDEEP 3072:OCOPi3tG24aqTB5w+Gkvb0AXj5iNyPpT4DG2k:MFEqTvwYoAXjiU4Dz
- TLSH T11A74CF11395FC773D3C20931C9AEBAD04BBE7C2F7796803BFB491B4B1EA124456662A1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\RCXF0D.tmp
- Size 284KB
- SHA256 e6bb2cb0242a67ce5b81eaae7006f7c1c649237c93d0c56bd93d3d1cb9807075
- MD5 fef25647774ed28d0aa369efe5364427
- SHA1 eb3c649b7f4fd9b64dc0f03122756a3cf88e411c
- SHA512 e15c20cba58f47fbf8185e5fa18a42892f98c96e0894f017a3d94052397acb98d7a23acae68d8dea5a87907a7c6a84dbac17b14fc40165678a1ae93810f48d55
- SSDEEP 3072:yCOPi3tG24aqTB4kvb0AXj5iNyPpT4DG2k:AFEqTRoAXjiU4Dz
- TLSH T1E654CF553C53C473E0410931C9968BD18BBE6C037AABD12BFB990B4B2EE139497B66B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\RCX1060.tmp
- Size 284KB
- SHA256 c6e40430bb67749359698a3d3c7ffc78b01be7d55a8b643f8ec5b41bfe6883d6
- MD5 10a406f80c2229234928386cbeafcb34
- SHA1 ca0505792e9b9fdbbff08033cd896ed3f16dedc3
- SHA512 43c792077cf52b7fd2fac8b39a81b312a51e93ef01b924aa6f02316bc1efe03266188718dc2d2dac5db70c38cf70bc9cc48b8cc053f01e9d522030f4e8b6821a
- SSDEEP 3072:OCOPi3tG24aqTBCokvb0AXj5iNyPpT4DG2k:MFEqTEoAXjiU4Dz
- TLSH T17F54D0513D63C473E041493188A68BD18BBE7C03BAABD11BFB591B4B1EF138097766B1
- MD5 SHA1 SHA512 SSDEEP TLSH