Analysis
- max time kernel
148s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/08/2026, 22:43
Behavioral task
behavioral1
Sample
2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe
- Size 288KB
- Sample260817-2ncfcaeb29
- SHA256 e1e1bf398b0ed918f8ce380fe69debe146d6e25aa3cf6786bc133093a762b59c
- MD5 1eccc26f28c7c41e0c376ad9e04da4eb
- SHA1 ecfe28b0a0055f45eb90c33fc6a8f6b21a19397b
- SHA512 bb013dd22860df8a43d3862cd4d9dce13fa8c63a043397977ab275fb680daf69f48f937e556df274564b4c37959f27d1246849d71ac63eaa76cfde511fc13d79
- SSDEEP 6144:tFlKgzelZNQSBQGH/CSpWqTcoAXjiU4bz1:qfBQGH6SfYoAX+U4F
- TLSH T1715401917DA2D8B3C0419A3148A68FA197376D139A65D203F7AD1F4B2F713D49B7B302
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Cosmu payload 3 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000d00000001c498-7.dat family_cosmu behavioral2/files/0x000400000001bb55-82.dat family_cosmu behavioral2/files/0x00060000000188c5-193.dat family_cosmu - Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\I: 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\K: 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\M: 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\D: 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\H: 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\J: 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\L: 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\N: 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\O: 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe - Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Control Panel\Desktop\Wallpaper = "C:\\windows\\WallPapers.jpg" 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.cab 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7zFM.cab 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCXD5A8.tmp 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCXD736.tmp 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iexplore.exe 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\dotnet.exe 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXD6EF.tmp 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.cab 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXD688.tmp 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.cab 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.cab 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.cab 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.cab 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7zFM.exe 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCXD544.tmp 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCXD554.tmp 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.cab 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.cab 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCXD8A1.tmp 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.cab 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7z.cab 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome.cab 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.cab 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCXD75A.tmp 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.cab 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCXD7FC.tmp 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.cab 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCXD82C.tmp 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCXD87E.tmp 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCXD8C2.tmp 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\dotnet.cab 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCXD702.tmp 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCXD7EB.tmp 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCXD523.tmp 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCXD5B8.tmp 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXD69A.tmp 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCXD713.tmp 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7zFM.cab 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCXD78B.tmp 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCXD82D.tmp 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.cab 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\windows\readme.1xt 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe File created C:\windows\WallPapers.jpg 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Desktop\General\WallpaperSource = "C:\\windows\\WallPapers.jpg" 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Desktop\General 2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-17_1eccc26f28c7c41e0c376ad9e04da4eb_elex_rhadamanthys_smoke-loader.exe"1⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:1748
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 330KB
- SHA256 fab9efc1decd632807c3f58bbd985e8a44748e37b45daa1af5c456440cebaad7
- MD5 f4afbdfe43ee2cc1b0a418fe32af6e02
- SHA1 0ae0ac2324b6da1eea8b80ca5f286d39f40b6e8f
- SHA512 b07f68cac2b931839f322b12e273e92ab35464f7f3685a8981d03daa7b9d36bc9f89613956639401986ec19bca185a5b446378a0b3017190b0e423a2df131143
- SSDEEP 6144:+FlKgzelZNQSBQGH/CSpWqTvoAXjiU4bz:5fBQGH6SfboAX+U4
- TLSH T1E57401817DA3D8B3D041493188A6CFA1973B6D13AA65D203FB9D0F4B2FB13D49B7A251
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\RCXD688.tmp
- Size 288KB
- SHA256 5dbc11b9dfd912781b480fa731ceb060269a587f9ffe6fb1e931ab2ba9f6a4b9
- MD5 651d4ee466270fef4895dfded4a1c1e8
- SHA1 a6b399255092fd355aa1834a6f2819b89832c465
- SHA512 d8824f903a58a3d23cfb3df9b96176d20b93210053c041274f163b7fca539f6e9fcb1b0d9941185edbfa14e1c389d29d4647dfd79ed8ce0e21807ab34f225a8b
- SSDEEP 6144:SFlKgzelZNQSBQGH/CSpWqTVoAXjiU4bz:1fBQGH6SfRoAX+U4
- TLSH T1265401917DA2D8B3D041493188A6CFA1973B6D13AA65D203FB9D0F4B2FB13D49B7B241
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\RCXD7DB.tmp
- Size 288KB
- SHA256 f13d1f7864850ad003e7f7ab2371fc8947ea4c08f91b188c03dd02a71b5273b1
- MD5 bcbe6d36634eb71d3eee254a4063e1e4
- SHA1 ae7a7724087e379e86b3a714b0ec20c87811f359
- SHA512 b0c3f1ed1b67b20447e8dd1ba243a373f65471f0b8f2bac10970dd041d34e9d85e1cc4ccb606582f9d48b2ce11cf58ba06537c63d5b79872f6ab8f0dbde8133d
- SSDEEP 6144:WFlKgzelZNQSBQGH/CSpWqTsoAXjiU4bz:RfBQGH6SfooAX+U4
- TLSH T1745401917DA2D8B3C0419A3188A6CBA197376D139A65D203FBAD1F4B2F713D49B7B301
- MD5 SHA1 SHA512 SSDEEP TLSH