Analysis
- max time kernel
148s - max time network
139s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/08/2026, 21:40
Behavioral task
behavioral1
Sample
2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe
- Size 284KB
- Sample260828-1jlb1stdra
- SHA256 da0593cc1428d8dfbd1aec8043fa3f1d0c2d7ab3bea3344465d78b08ae18593a
- MD5 132ac8e3221f39161a9ec6c5b181ff6c
- SHA1 c108df0bfbd2587c16908f1808e98244dc79f2ca
- SHA512 66afc200a79d8ca1ca8ccd0a5722905e64dff43044e43963d7a561841a7a990cc3b37478cace4e46f4a2731ba06c967208b2cb77c77fa55ed59a30d217bfdd40
- SSDEEP 6144:dFlKgzelZNQSBQGH/CSpWqTLoAXjiU4bz1:6fBQGH6SfvoAX+U4F
- TLSH T19D5402457D93C4B3D0414D3188E68BE14B7F6C137AA6E11BFB9D0B4B1EB13884BAA761
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000e00000001c4ab-6.dat family_cosmu behavioral2/files/0x000e00000001c4b6-81.dat family_cosmu behavioral2/files/0x0006000000018895-192.dat family_cosmu behavioral2/files/0x000d00000001c4cb-251.dat family_cosmu - Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\H: 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\I: 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\K: 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\L: 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\J: 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\M: 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\N: 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\O: 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\D: 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\Application\chrome.exe 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\readme.1xt 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX2A26.tmp 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX2A38.tmp 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX2A49.tmp 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX2B36.tmp 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCX2952.tmp 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.cab 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX2AE3.tmp 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ExtExport.exe 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7zFM.cab 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ieinstal.cab 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.cab 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.cab 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.cab 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX2AA0.tmp 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.cab 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX2BAB.tmp 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX2BCE.tmp 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.cab 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.cab 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX290D.tmp 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX2AB2.tmp 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\RCX2BBD.tmp 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7z.exe 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.cab 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX2A7F.tmp 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX2AD3.tmp 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX2B66.tmp 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\crashreporter.cab 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.cab 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX28EB.tmp 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX2A25.tmp 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.cab 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX2B78.tmp 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX2A4B.tmp 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX2A5E.tmp 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX2A80.tmp 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-28_132ac8e3221f39161a9ec6c5b181ff6c_elex_rhadamanthys_smoke-loader.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4348
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 322KB
- SHA256 4197dc446ad22088751eb030b8efad24d2aebc801e5d9f8e6fae38127fa3ec41
- MD5 26fea99b9d36f458c6b2130a4d0bc987
- SHA1 d4cf7f1675cf6a9cfc10e04cb1a7bb6056d9071b
- SHA512 0de26785c0d1c1cef29d2d2e5610c883492a3015cca235dd2d3a4e07377e628a2ee9c097897ce5cee1b6420d9082ead486bd555a339c41d9d4ece1d66c237ee3
- SSDEEP 6144:wFlKgzelZNQSBQGH/CSpWqTyoAXjiU4bz:HfBQGH6SfeoAX+U4
- TLSH T1A264F1457D93C4B3E0414D31C9E68AE14B7E6C037AA6E11BFF5D0B4B1EB13884BA66B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\RCX2A36.tmp
- Size 284KB
- SHA256 e995e26e7bbf0ff389304e74357dcec2421ef0f350188fcfe9047d84b6b96f63
- MD5 8db31740403d7246f070b364f004d89e
- SHA1 e7309b99b7c7e8226fb1eb5310422ef009cb3a79
- SHA512 aa34f52110f098e3b89800100845ae4c3da9c439e3b0526d2d8caa292e565312ac7c434308d50497e49e0ae3a39edc48d0795209bac137c03376073d29b2ffb9
- SSDEEP 6144:cFlKgzelZNQSBQGH/CSpWqTRoAXjiU4bz:7fBQGH6SfdoAX+U4
- TLSH T18854F1457D93C4B3D0414D31C9E68BE14B7E6C037AA6E11BFB5D0B4B1EB13884BAA6B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\RCX2B79.tmp
- Size 284KB
- SHA256 543711c9a6edcccb1a62a39ece2d6d71c09176abbe26e34eab861f7400cda446
- MD5 025fc8f4fadc2e9b14bb4dc9a2c1e3d4
- SHA1 9f2a200efb91fb1e92af8e6ec8aacb6da7cca0b8
- SHA512 c903ca20c66db48ed78be54223df576bafd8cd4a8f1d6217d69e2302f014e5955d72ea8acb56bf1450b6ca22347fbe0247142f173c090459f3a80570ee8ac7e6
- SSDEEP 6144:IFlKgzelZNQSBQGH/CSpWqTEoAXjiU4bz:/fBQGH6SfwoAX+U4
- TLSH T1095402457D93C4B3D0414D3188E68BE18B7F6C137AA6E11BFB5D0B4B1EB13844BAA261
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe
- Size 322KB
- SHA256 2f579b47085888e1073b40d74f3894e4d4fcbe93d5bd1247d5ae62c2ebc4c95b
- MD5 d4f5b1a39a20fda7bc3212aa03b7a2a8
- SHA1 ecda0dea2ac55c192558d895239a5c0cfd9ea3f4
- SHA512 5d64602361769e7b2f09f81f9fa03bf05ce5231ac156bf59a8ea7de767a508aaa2f66e867d7bcbbfae4f6fd1d937718081450cd21ed0cd54fa4397d6300ed849
- SSDEEP 6144:UFlKgzelZNQSBQGH/CSpWqTjoAXjiU4bz:TfBQGH6SfnoAX+U4
- TLSH T1A06402457D93C4B3E0414D3188E68BE18B7F6C137AA6E11BFB5D0B4B1EB13884BA6671
- MD5 SHA1 SHA512 SSDEEP TLSH