Analysis
- max time kernel
148s - max time network
132s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
21/08/2026, 05:21
Behavioral task
behavioral1
Sample
2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe
- Size 1.4MB
- Sample260821-f2am1stdrd
- SHA256 1bdd5f97ed6c9e7620a8d0249d4f2090073486d4b5a303fc907ca98c8c04ce4c
- MD5 96233ea555339d846161d653038edb20
- SHA1 4c8f416e5808244ce99441e309cbae2032b693c1
- SHA512 c819b100512652993df01bf148b7f525ef6f050a6cd8b6c4ee68b40b4c286e8649a80973ff8b6ab439c67724f730ec5c1fbcef334435e271cb4a104b05971be9
- SSDEEP 24576:Wfa86Sf7kQ5W9GIpThCTZ0og6f5MLb+VONw/haSqnFGUMhglHZaaw+Xa9:WfayQL9fpTgTZ0og6fWLb+VOa/hunKhv
- TLSH T1BE65DFC2F602D0A5DC1645308C27DFF81B16BE22AD1116177BD8BF5FAEB3382592259B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Cosmu payload 3 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000e00000001c582-6.dat family_cosmu behavioral2/files/0x000d00000001c58e-81.dat family_cosmu behavioral2/files/0x00060000000188c5-192.dat family_cosmu - Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\J: 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\L: 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\M: 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\N: 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\O: 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\G: 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\K: 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\D: 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\H: 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Internet Explorer\iexplore.cab 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.cab 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX9EA7.tmp 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX9ECB.tmp 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXA0EA.tmp 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCXA1FB.tmp 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCXA24F.tmp 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCXA270.tmp 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7z.exe 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXA12A.tmp 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCXA1E9.tmp 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXA171.tmp 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCXA195.tmp 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCXA23C.tmp 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCXA03B.tmp 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.cab 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.cab 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.cab 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXA160.tmp 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.cab 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXA173.tmp 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.cab 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX9EB9.tmp 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\dotnet.exe 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.cab 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ExtExport.cab 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iediagcmd.cab 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.cab 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCXA20C.tmp 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.cab 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.cab 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCXA1C8.tmp 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iexplore.exe 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXA15F.tmp 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCXA26F.tmp 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.cab 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.cab 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCXA271.tmp 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX9EA8.tmp 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX9FF8.tmp 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.cab 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCXA1E8.tmp 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.cab 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXA0D9.tmp 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-21_96233ea555339d846161d653038edb20_elex_rhadamanthys_smoke-loader.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4172
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 337KB
- SHA256 030019ca0a640b85647fb0f1bd4ebd2b0e47c93845d155dbf76b8a4dc9a78b5a
- MD5 e4b894eab6269dfc8eff049efdf70713
- SHA1 8e781a25a86985910e9226a35b8c0ad2e8a54661
- SHA512 90efb93e993a8ed8b7eac48020ce473092c0da9442d53a6745925f3f91a8a41c29666e9ed32b9835e0e7f17a9c31e4b60bb9fed6d8b7415e236b52e9f93087dc
- SSDEEP 6144:vFlKgzelZNQSBQGH/CSpWqTvoAXjiU4bz:AfBQGH6SfboAX+U4
- TLSH T1627401817DA3D8B3D041493188A6CBA1973B6D13AA65D203FB9D0F4B2FB13D49B7A351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\RCXA12B.tmp
- Size 288KB
- SHA256 e02c4924aa0d9098d4c71bcd5cf1734535618c5f0201c4c9f7b89769104a33a9
- MD5 e5a349fe16f7802345395404bc5ef94b
- SHA1 8148fdd2db6b45e0fc2dddcd0f9cf8288a5494b1
- SHA512 bd3a99251c3eff24d25f9de0a1ea2091a7e1fb10f350569ecddab70234ae73f4f36683811ede8fca96c11bd59b833690e0bbefa611154df2a6ff6fc76b7097a9
- SSDEEP 6144:bFlKgzelZNQSBQGH/CSpWqTVoAXjiU4bz:kfBQGH6SfRoAX+U4
- TLSH T1095401917DA2D8B3D041493188A6CFA1973B6D13AA65D203FB9D0F4B2FB13D49B7B241
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\RCXA24F.tmp
- Size 288KB
- SHA256 0e64ef81a2e148ce82eb17acbdb59bb2e8605c17ef6a46319fc2cbfc6febbc67
- MD5 c85288f9246ef2a9d64f14d661231ed1
- SHA1 45bf09d77c34e455e4688135e467e8375cd787ce
- SHA512 31412761545e37ae10ebfa9edb1b5a364adf740c847a8ed8edbf808309c75fff4a15cb49ade6269bbb8fb67441979b2b50f0ef70731fd727c4fd87539a9f6dc4
- SSDEEP 6144:/FlKgzelZNQSBQGH/CSpWqTsoAXjiU4bz:wfBQGH6SfooAX+U4
- TLSH T1925401917DA2D8B3C0419A3188A6CBA197376D139A65D203FBAD1F4B2F713D49B7B301
- MD5 SHA1 SHA512 SSDEEP TLSH