Analysis
- max time kernel
148s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
26/08/2026, 02:49
Behavioral task
behavioral1
Sample
2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe
- Size 328KB
- Sample260826-dbbfhsysdw
- SHA256 38b758cfc0aee86780f5fc3e7b1816b5c765859a0d5656afce3ca28fa1b50e95
- MD5 f121c7c648def06113dc2366a80263dd
- SHA1 efaa220b856481c0c47e152aa74627590f521462
- SHA512 ea643a9cf8a235e8ef1e958b2b612f8593432adecb731d142482440edf021306c6a379877aafd58720ec6b971bad228bcd043360acc9c9676ee1c6b8098eb492
- SSDEEP 6144:oFlKgzelZNQSBQGH/CSpWqTxoAXjiU4bz:ffBQGH6SfdoAX+U4
- TLSH T1466401917DA2D8B3D0418A3148A68FA197376D13AA65D203FBAD1F4B2F713D49B7B301
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Cosmu payload 3 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000d00000001c350-7.dat family_cosmu behavioral2/files/0x000400000001bb55-82.dat family_cosmu behavioral2/files/0x00070000000188c5-193.dat family_cosmu - Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\G: 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\J: 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\K: 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\O: 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\H: 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\I: 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\L: 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\M: 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\N: 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe - Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Control Panel\Desktop\Wallpaper = "C:\\windows\\WallPapers.jpg" 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\RCX4905.tmp 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCX499E.tmp 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX4A92.tmp 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.cab 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\readme.1xt 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX4948.tmp 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX4AFB.tmp 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX4AC6.tmp 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7zFM.cab 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7zFM.exe 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.cab 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.cab 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.cab 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX4A81.tmp 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX4B50.tmp 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ielowutil.exe 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX4949.tmp 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX497B.tmp 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.cab 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.cab 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCX49BF.tmp 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX4A6E.tmp 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX4AC7.tmp 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX4AFA.tmp 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX4BB4.tmp 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ExtExport.exe 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX4BF9.tmp 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.cab 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX4BC6.tmp 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX4BC7.tmp 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\dotnet.exe 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX4B2D.tmp 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.cab 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX4B51.tmp 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ExtExport.cab 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.cab 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCX498C.tmp 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX4A91.tmp 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7z.cab 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX4916.tmp 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX4A93.tmp 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iexplore.cab 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX4A6F.tmp 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX4AE8.tmp 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ieinstal.exe 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX4B92.tmp 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.cab 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX4B0C.tmp 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\windows\readme.1xt 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe File created C:\windows\WallPapers.jpg 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Desktop\General 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe Set value (str) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Desktop\General\WallpaperSource = "C:\\windows\\WallPapers.jpg" 2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-25_f121c7c648def06113dc2366a80263dd_elex_rhadamanthys_smoke-loader.exe"1⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:2944
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 326KB
- SHA256 22723f62e9f3f9e90010652a6edd285346f3a99b4073b3650bc72fb35d56586b
- MD5 d2cbaca9569c7be8bfb79f5c86daf2de
- SHA1 730a63206f8d03eef51a057f29cbb7162ce69c70
- SHA512 5955d65bbcd814dc6b4e16f14482acd0a449a6f2000ce49b6be6df38515065c0d8b02ec24d3e932c3102b635666de1e0d27d4568a925f5f120f1f82edd70d654
- SSDEEP 6144:QFlKgzelZNQSBQGH/CSpWqTvoAXjiU4bz:nfBQGH6SfboAX+U4
- TLSH T1D36401817DA3D8B3D041493188A6CBA1973B6D13AA65D203FB9D0F4B2FB13D49B7A351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\RCX4A80.tmp
- Size 288KB
- SHA256 d1036590b37b2a0feba6004d6c4796ebdf218c1ab7337808daf3616ec97e8742
- MD5 009aba487c572cb73ff1245d42fe0e57
- SHA1 c1a68643a4b74753455845ba0988f03cd7c13f61
- SHA512 93845b5119e57eabecb1904912270bb4e9b56ff4c71af9592597c6b770f569b98f2bc184a49ebbff9b5d40edf48d3c3b69dae063249a0209088aa6f51f93039f
- SSDEEP 6144:cFlKgzelZNQSBQGH/CSpWqTVoAXjiU4bz:7fBQGH6SfRoAX+U4
- TLSH T1A55401917DA2D8B3D041493188A6CFA1973B6D13AA65D203FB9D0F4B2FB13D49B7B241
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\RCX4BA3.tmp
- Size 288KB
- SHA256 1b1604b642a0dc96bc207bbb819dfb3701bc990a70615d418245d9485d02f7cf
- MD5 9d641e5734375557ea46875edd8443a6
- SHA1 dd94cfaf5d20ce480e2ca0e856df00468e4fb034
- SHA512 e0fb2dc7c4b481e31e39a27509ac99584d1c76bda6eab01673e5004e54266c465eda3df307c4f234590d9116e8f74f31681b6132c7c338d86716d5cf0d4710f4
- SSDEEP 6144:oFlKgzelZNQSBQGH/CSpWqTsoAXjiU4bz:ffBQGH6SfooAX+U4
- TLSH T1FA5401917DA2D8B3C0419A3188A6CBA197376D139A65D203FBAD1F4B2F713D49B7B301
- MD5 SHA1 SHA512 SSDEEP TLSH