Analysis
- max time kernel
148s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/08/2026, 16:21
Behavioral task
behavioral1
Sample
2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe
- Size 1.5MB
- Sample260816-tt12wsed75
- SHA256 ca49aa804bff9dd4f88c1f889e554737e1f41122de8d91e36c45c2340d956436
- MD5 fbc7cacbe8e30d3143ec323c2a217454
- SHA1 63b88569a8bcf2cfc9d7ed977fa55783653709a3
- SHA512 de47031093133d1176613bc66a7b46983582edda47ac4831c93b2bc0a2367240a9d98e61fb4da8aa0d67b432ec9695a76ff6df13b5644b618e66ebc420208a01
- SSDEEP 6144:ZFlKgzelZNQSBQGH/CSpWqTdoAXjiU4bz:ufBQGH6SfJoAX+U4
- TLSH T1D87501817AA2D8B3C4429A314CA6CF6197377D139A65D203B7AD1F4B2F713D09B7A302
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Cosmu payload 3 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000200000001b313-6.dat family_cosmu behavioral2/files/0x000e00000001c552-81.dat family_cosmu behavioral2/files/0x000500000001898c-192.dat family_cosmu - Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\M: 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\O: 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\D: 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\G: 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\I: 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\J: 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\L: 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\N: 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\H: 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\chrome.cab 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.cab 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX73C3.tmp 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7z.exe 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCX71D5.tmp 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCX7216.tmp 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX72F5.tmp 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.cab 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iediagcmd.cab 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.cab 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.cab 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX749C.tmp 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX732C.tmp 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX72D4.tmp 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX748B.tmp 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.cab 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX71B5.tmp 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX737F.tmp 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.cab 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX7457.tmp 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCX71E6.tmp 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\crashreporter.cab 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCX71E7.tmp 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX733F.tmp 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX7391.tmp 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX7405.tmp 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.cab 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\RCX74BC.tmp 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.cab 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX748A.tmp 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX713F.tmp 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX736F.tmp 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ieinstal.exe 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.cab 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.cab 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome.cab 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX72E5.tmp 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX73F5.tmp 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.cab 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7zFM.cab 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX72F6.tmp 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iexplore.exe 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.cab 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7z.cab 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-16_fbc7cacbe8e30d3143ec323c2a217454_elex_rhadamanthys_smoke-loader.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1860
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 333KB
- SHA256 dd976b56b73db6c86cb8cfec910c17fd05c83c9e0043e9ea89b49b815ea34ef7
- MD5 f6ad0210d59e52b86e08d4e9337c8739
- SHA1 823739e1ebb518b17435e18f78baff7cb9e8149d
- SHA512 3895eb6e382ff9111ce2bae900a430c837f19653198b3507562efc7fdd3551a1f99457b43384cf317a7e3f74bbd7f2f6f9b68044385e5ebdfa97febab5ea0f40
- SSDEEP 6144:5FlKgzelZNQSBQGH/CSpWqTvoAXjiU4bz:OfBQGH6SfboAX+U4
- TLSH T19F7401817DA3D8B3D041493188A6CBA1973B6D13AA65D203FB9D0F4B2FB13D49B7A351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\RCX7307.tmp
- Size 288KB
- SHA256 e6b82a968b9863ef9e01665338849b15b26b05a85a5900d5f1ba98375bbd9d61
- MD5 9fa97592a34c785144ecb4ffbf569aa7
- SHA1 11ace1d54b4f4aa00ee5d6ec4074681107903601
- SHA512 8c14582a5e053973beb09e8b1eab1e50b8a9ddb8955d8242dbb87dac02ff92c8c67327267cf303113473664e021723cfd113ac2f41f80c49a313c0ab4afcac36
- SSDEEP 6144:9FlKgzelZNQSBQGH/CSpWqTVoAXjiU4bz:afBQGH6SfRoAX+U4
- TLSH T1A35401917DA2D8B3D041493188A6CFA1973B6D13AA65D203FB9D0F4B2FB13D49B7B241
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\RCX7469.tmp
- Size 288KB
- SHA256 99bccb89a9e78d6a029d0ba975b836c15444256c741ea930df57fabb3fa32e0a
- MD5 f729c3ed47ed425406e4dad35d3ffef9
- SHA1 6811f30abdc1a3e701d5cbaf85f29b2c0f3c3115
- SHA512 c274fe0f58c423a9787e839b9e535bd0d9889b36333be184369d3d7560c9022af9bf7f383ca32368e1727a4de7de4788abedb5891f69424ed150d98bac8acfd2
- SSDEEP 6144:pFlKgzelZNQSBQGH/CSpWqTsoAXjiU4bz:efBQGH6SfooAX+U4
- TLSH T1025401917DA2D8B3C0419A3188A6CBA197376D139A65D203FBAD1F4B2F713D49B7B301
- MD5 SHA1 SHA512 SSDEEP TLSH