Analysis
- max time kernel
148s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
26/08/2026, 02:03
Behavioral task
behavioral1
Sample
2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe
- Size 296KB
- Sample260826-cgzvmabd79
- SHA256 9b36a95a3ca4bbe3fdc4350dffd6510669472d348f6533f41248fc1586d9227d
- MD5 f4903cf5026d228aa48b66c12e530bfa
- SHA1 036e8192a7254a068d8a7fcdea266caaf0de1af2
- SHA512 81bf083ea2d98cd09f57d5db59c649c13ed773e148c5c43285a7cafbbe5dc16cd409060fb2c4e75bdcef6bdc2da60b7e785ce08e9da0c2013e6f6be2340dcac9
- SSDEEP 6144:mFlKgzelZNQSBQGH/CSpWqTVwloAXjiU4bz:BfBQGH6Sf+loAX+U4
- TLSH T13C54E0403A9ECBB2D3C249318C6EFAE1477A7C2FAB559137F7983B0F1E712845666241
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Cosmu payload 3 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000d00000001c52d-7.dat family_cosmu behavioral2/files/0x000d00000001c546-82.dat family_cosmu behavioral2/files/0x000700000001898a-193.dat family_cosmu - Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\I: 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\J: 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\K: 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\L: 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\N: 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\G: 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\H: 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\M: 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\O: 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe - Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Control Panel\Desktop\Wallpaper = "C:\\windows\\WallPapers.jpg" 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX8E2.tmp 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.cab 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX834.tmp 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX915.tmp 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX989.tmp 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX6BF.tmp 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX845.tmp 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.cab 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX967.tmp 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.cab 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX8BF.tmp 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.cab 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.cab 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCX726.tmp 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX858.tmp 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX86A.tmp 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX9BC.tmp 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7zFM.cab 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCX748.tmp 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.cab 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX99B.tmp 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCXA01.tmp 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7zFM.cab 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.cab 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX935.tmp 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX9DE.tmp 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCXA13.tmp 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX9AC.tmp 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.cab 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7zFM.exe 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\dotnet.cab 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.cab 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX86B.tmp 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.cab 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\dotnet.exe 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX857.tmp 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX89E.tmp 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ExtExport.exe 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iexplore.cab 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX6F4.tmp 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.cab 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX99A.tmp 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\RCX9CD.tmp 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\crashreporter.cab 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iexplore.exe 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX6D1.tmp 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\windows\readme.1xt 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe File created C:\windows\WallPapers.jpg 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Desktop\General 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe Set value (str) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Desktop\General\WallpaperSource = "C:\\windows\\WallPapers.jpg" 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader.exe"1⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:1496
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 328KB
- SHA256 cb74baf81eae114bbd38a9682511ec254da1efbc9936b9345d441b46aac995da
- MD5 f9a9bb793e11d7fb71f97cbfb65a11dd
- SHA1 7640d1bebb6691484554ca4b552423959cfa5413
- SHA512 0755de7a4edb7198d9a380a1465933675a226b7252358c51703d08950af0afe7083f5b474fe0a4a4259d342bfdabbd24cf9ee395129ffd0a05cc5f7ac53b898e
- SSDEEP 6144:OFlKgzelZNQSBQGH/CSpWqTyoAXjiU4bz:pfBQGH6SfeoAX+U4
- TLSH T1AA64F1457D93C4B3E0414D31C9E68AE14B7E6C037AA6E11BFF5D0B4B1EB13884BA66B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\RCX847.tmp
- Size 284KB
- SHA256 971b625a967afec5947d25cb77685b9aac4b40e632d1397ea642347f93a8ab11
- MD5 d6810a4d834a4229552149c938e25a78
- SHA1 107667ccb1a73b3d4e4c3db31cbb47e52d8b73da
- SHA512 6194d81901a826f4127cb943a54c0809b0850366b6f46616ddf5f6621ccef5df2b72cbd93b025f1ce4c13b5daf5a30bc5f57b3b08aaa2606d6525d9be4c22628
- SSDEEP 6144:qFlKgzelZNQSBQGH/CSpWqTRoAXjiU4bz:tfBQGH6SfdoAX+U4
- TLSH T13F54F1457D93C4B3D0414D31C9E68BE14B7E6C037AA6E11BFB5D0B4B1EB13884BAA6B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\RCX98A.tmp
- Size 284KB
- SHA256 dc52940fe0cdb4da999f7ebd6cd17609df02dbc8e9a8e70ca3680520280f36e2
- MD5 65cba608a161013124a5f937e049a8fb
- SHA1 13db651e4167d233fec6b247fdc1e4ac5ccaa019
- SHA512 8cc0ad0193431924876878e369196c99f420788dadd3c210ced2c220f3e8f278de9c26af7946d895e3f3a57b16085b072d37a473f7b6493c094a33f15f728a50
- SSDEEP 6144:uFlKgzelZNQSBQGH/CSpWqTEoAXjiU4bz:JfBQGH6SfwoAX+U4
- TLSH T1915402457D93C4B3D0414D3188E68BE18B7F6C137AA6E11BFB5D0B4B1EB13844BAA661
- MD5 SHA1 SHA512 SSDEEP TLSH