Analysis
- max time kernel
150s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/08/2026, 17:59
Behavioral task
behavioral1
Sample
2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe
- Size 284KB
- Sample260822-wk51laap7t
- SHA256 026f8a663fce54ddca10e332ef41945bbe2ed0f955bb0b15d8d962b5052fa983
- MD5 20f44d8461bd26b01d302454ba7cb05c
- SHA1 fbadbf1a66ef476515f21a24f7dc2b22cee23069
- SHA512 60043ba914063f7f404afb95c7a7d203ab372c342b862f3c3bb38462c2146bc4b9ec8f08720329ec61b3f25e8f7bf5e7b16a414c203a3ded01d42a0355e1baa3
- SSDEEP 6144:aFlKgzelZNQSBQGH/CSpWqTaoAXjiU4bzF:9fBQGH6SfuoAX+U41
- TLSH T1295402457D93C4B3D0414D3188E68BE19B7F6C137AA6E11BFB9D0B4B1FB13844BAA261
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Cosmu payload 5 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000e00000001b896-6.dat family_cosmu behavioral2/files/0x000d00000001c50e-56.dat family_cosmu behavioral2/files/0x000e00000001c511-81.dat family_cosmu behavioral2/files/0x000300000001bb56-173.dat family_cosmu behavioral2/files/0x000300000001b983-249.dat family_cosmu - Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\G: 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\J: 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\K: 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\M: 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\N: 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\D: 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\H: 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\I: 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\L: 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\RCX3628.tmp 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX35B4.tmp 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7zFM.exe 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX36CB.tmp 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.cab 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ielowutil.exe 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX35A2.tmp 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX33FD.tmp 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX340D.tmp 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\dotnet.cab 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\readme.1xt 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7zFM.cab 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX3590.tmp 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.cab 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX357F.tmp 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX3606.tmp 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX3607.tmp 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX3648.tmp 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iediagcmd.cab 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX358F.tmp 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX341F.tmp 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.cab 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX36ED.tmp 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ExtExport.exe 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.cab 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.cab 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ieinstal.exe 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCX3490.tmp 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iexplore.exe 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX3805.tmp 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7z.exe 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCX34A1.tmp 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX3659.tmp 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX368A.tmp 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.cab 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX37A2.tmp 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX33BD.tmp 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-21_20f44d8461bd26b01d302454ba7cb05c_elex_rhadamanthys_smoke-loader.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5776
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 322KB
- SHA256 80c3c7f17801715409578470631fec5b16f10a83d11d2c20a59401882ed8af28
- MD5 f71aaec61f5dfdcba2f485dc2a3cc958
- SHA1 52411d9482fcc23cc15dac71438a57172491d280
- SHA512 a015b1a860740528a069831ebe93251d41950693ee793493fe389601f3945ea3232f52eb3701360e20d424a28d85dc2a5a25128ab06762ee225bab45ad70b040
- SSDEEP 6144:JFlKgzelZNQSBQGH/CSpWqTyoAXjiU4bz:+fBQGH6SfeoAX+U4
- TLSH T19B64F1457D93C4B3E0414D31C9E68AE14B7E6C037AA6E11BFF5D0B4B1EB13884BA66B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 1.5MB
- SHA256 42c34c138657857714bdb634020c598e413da82a62e374508330ff357bb6a5c7
- MD5 73aa715d723c8e08ca883cec2a3cc437
- SHA1 8d8f7ac8f63eee09d427e0e382ffef40475d2a13
- SHA512 6dd2bb5d3207e5f4596c2ace2e471297f51f1d334e433a35574069ee73916a2a27853f6cf463583e39a70233d950445bc0ce9f5d62ad63e5a2d2124a84c283ed
- SSDEEP 6144:BFlKgzelZNQSBQGH/CSpWqTfoAXjiU4bz:WfBQGH6SfzoAX+U4
- TLSH T1BB6502457D93D4B3D0414D3188E78BE18B7F6C137AA6E11BFB9D0B4B1EB13884BA6261
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\RCX3590.tmp
- Size 284KB
- SHA256 6b0b479ebd3b75a7fa42dcc1ccec189285f9eb9eb6c12c0ab24ffec83c411932
- MD5 1f8b065a03f31ccf35ff2fa631241e41
- SHA1 47cf3e9dfaf2ed127d4492516c837e68670367b0
- SHA512 aa9ff89f0c082da5deccb803168d92924faf6d5a9e99a54b4ef355420ff97fbe92e47cc4e101e076a6e692a9b47763abd0128b3b0513e262d36f087333d24003
- SSDEEP 6144:1FlKgzelZNQSBQGH/CSpWqTRoAXjiU4bz:SfBQGH6SfdoAX+U4
- TLSH T1D354F1457D93C4B3D0414D31C9E68BE14B7E6C037AA6E11BFB5D0B4B1EB13884BAA6B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe
- Size 346KB
- SHA256 2992a4e57c239b231d1eb749a3c409afc6c1f597c1b54154489e10f3db5c00ea
- MD5 0a9cf3a6af6081c615cacfb5251d4fb5
- SHA1 15081f0d1ebb3d56b479916197b0e9b5fae165de
- SHA512 9dea8ee7b98c6de7890b6b16504d639e478aa581ec5e9af0287d33a3198482f0523726a4c4de3dac813dac61d22b865e3d3de711d68d54ea68c68e2b1913b170
- SSDEEP 6144:sFlKgzelZNQSBQGH/CSpWqT3UjD56oAXjiU4bz:rfBQGH6SfDUjD56oAX+U4
- TLSH T16F74F1413E93C4F3D440093188A78FE19B3F6C23BAD5E207FB993B4B9EB13845A66655
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 284KB
- SHA256 0625e7591dd6774b7cd19e16eb21fa9f9709417f405ade5e0e17967cd5e9582d
- MD5 472972e6675728d0a6aa2bb7799955bc
- SHA1 d5d5f357215505b7becb6cecff72afa9eaba2c8b
- SHA512 c9ca0b05b8d8f349d040d04a2fc3323f01a3d43be187b2eb21fc842dc01e59026889e4797e23ef0c2e3778973a220daef7a285ff22c47b55a1ac17572c3863ee
- SSDEEP 6144:BFlKgzelZNQSBQGH/CSpWqT1oAXjiU4bz1:WfBQGH6SfpoAX+U4F
- TLSH T1D95402457D93C4B3D0414D3188E68BE19B7F6C137AA6E11BFB9D0B4B1EB13844BA6361
- MD5 SHA1 SHA512 SSDEEP TLSH