Analysis
- max time kernel
148s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
26/08/2026, 03:46
Behavioral task
behavioral1
Sample
2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe
- Size 284KB
- Sample260826-ebyrgsyvgw
- SHA256 0ecacb16824d83ee97cacb7abcf624f7d803f4173e41225901a4dd5a5f24d0d5
- MD5 eb89610a06f2504ed6b509f022499cfb
- SHA1 a148280df83b10eabcf52b966c21c0ac89c39c40
- SHA512 9c39cfca58958bc24ea59be25e13a06b1f32b5b9a2858beabf724a0157378cccc59ad904fa5b089873e98fdfceaf460f3abfc00190935158399f17d324c86a99
- SSDEEP 6144:AFlKgzelZNQSBQGH/CSpWqT3oAXjiU4bzF:3fBQGH6SfzoAX+U41
- TLSH T11B5402457D93C4B3D0414D3188E68BE19B7F6C137AA6E11BFB9D0B4B1EB13844BAA361
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Cosmu payload 3 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000e00000001c4b2-6.dat family_cosmu behavioral2/files/0x000400000001ba98-81.dat family_cosmu behavioral2/files/0x0005000000018977-192.dat family_cosmu - Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\L: 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\N: 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\I: 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\M: 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\O: 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\D: 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\G: 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\H: 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\J: 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\Office16\RCXABEE.tmp 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCXAB03.tmp 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.cab 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCXA8FE.tmp 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\dotnet.cab 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCXA987.tmp 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXAA35.tmp 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCXAB66.tmp 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCXA964.tmp 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXAA6F.tmp 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCXAC33.tmp 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCXA911.tmp 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iediagcmd.cab 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\readme.1xt 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXAA46.tmp 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCXABDD.tmp 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ielowutil.exe 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXAA45.tmp 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXAA59.tmp 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ieinstal.cab 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.cab 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCXA965.tmp 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXAA6D.tmp 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iexplore.exe 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCXABA9.tmp 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7zFM.cab 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCXA900.tmp 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCXA922.tmp 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCXA988.tmp 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXAA58.tmp 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCXAB24.tmp 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.cab 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.cab 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCXABFE.tmp 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7zFM.exe 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCXA943.tmp 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7z.cab 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7zFM.cab 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXAA5A.tmp 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.cab 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.cab 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.cab 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-25_eb89610a06f2504ed6b509f022499cfb_elex_rhadamanthys_smoke-loader.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1100
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 333KB
- SHA256 c3de7b9f8d1db8e71c4b50db1fd6eaf3e3e8b924daa9eb9bbe0538ba5d0b3e60
- MD5 71af5b02889603e8ae5bc7d8912441c2
- SHA1 53290cda2e2d88d03c08770c429487d216a5734a
- SHA512 dd1978266407a3f180cf8625ff6469152f47ab2ae1d99da89a1c9abb49a35c14a833bb8c71dd74ed5a1a576ecca936bf11afd41a8f5233a85c6562bc4d9f2565
- SSDEEP 6144:jFlKgzelZNQSBQGH/CSpWqTyoAXjiU4bz:sfBQGH6SfeoAX+U4
- TLSH T17174F1457D93C4B3E0414D31C9E68AE14B7E6C037AA6E11BFF5D0B4B1EB13884BA66B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\RCXAA58.tmp
- Size 284KB
- SHA256 4ab2679bd28f1e64d9a04949193f1213c2f4cf676933452737ea2ca3006b8e06
- MD5 2f800204e4395393079b301f7eeb0030
- SHA1 45a12fe40b6660cfeed1d0bfb8765d31dc22a555
- SHA512 95632b882724fce8dea68239e20d3be54fe7812a28be44f0dc3276151235b9169d1f802c02ec870ae8e6bc31e2acd2b0a2a66ee8ab90b44c5b5c7f257526cfca
- SSDEEP 6144:/FlKgzelZNQSBQGH/CSpWqTRoAXjiU4bz:wfBQGH6SfdoAX+U4
- TLSH T1D554F1457D93C4B3D0414D3189E68BE14B7E6C037AA6E11BFB5D0B4B1EB13884BAA6B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\RCXABBA.tmp
- Size 284KB
- SHA256 d9e6236fa09e0dcfddb0a669394e220c6256b068816d9931d0261b4b2c14f5d8
- MD5 e09dc2366f4a15614c1314cb903e89fe
- SHA1 ede8dd7e6af5ce45cbcb10ce749c251c2fd38b90
- SHA512 9609aeca3ea8b7f5d7d71b4a0e0c025621bc550182b2fca592b65a76ed1949dc6506469c6b798717280e01dd3c157182193d51fead543fa16e5f6c804ebcc0bc
- SSDEEP 6144:TFlKgzelZNQSBQGH/CSpWqTEoAXjiU4bz:8fBQGH6SfwoAX+U4
- TLSH T1E05402457D93C4B3D0414D3188E68BE19B7F6C137AA6E11BFB5D0B4B1EB13844BAA261
- MD5 SHA1 SHA512 SSDEEP TLSH