Analysis
- max time kernel
148s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/09/2026, 12:14
Behavioral task
behavioral1
Sample
2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe
- Size 1.5MB
- Sample260903-pefeeshb22
- SHA256 17b2962bc20adacd18346a192aaf712fdaf64e3248622d9288b679b7af0265ee
- MD5 500033b49f360c6b1367f27099108a24
- SHA1 d34dd204f62e256d25e7a8a4d9bee5042463a694
- SHA512 d5ce9f01633083065feb2181314ff4f7f5c87a93a694db2ec40d03d67e8acf1eae3326a1afe961e395de000a7064cf90b2e52f3fd9c2b028c98442031d0fa07d
- SSDEEP 6144:3FlKgzelZNQSBQGH/CSpWqTdoAXjiU4bz:ofBQGH6SfJoAX+U4
- TLSH T15D6501817AA2D8B3C4429A314CA6CF6197377D139A65D203B7AD1F4B2F713D09B7A302
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x001600000001c43a-6.dat family_cosmu behavioral2/files/0x000d00000001c4c6-81.dat family_cosmu behavioral2/files/0x000400000001bb54-92.dat family_cosmu behavioral2/files/0x0006000000018895-192.dat family_cosmu - Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\G: 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\J: 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\L: 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\N: 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\D: 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\H: 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\I: 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\K: 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\M: 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX40E.tmp 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCXE3.tmp 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.cab 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.cab 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX45F.tmp 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCX4F2.tmp 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCX177.tmp 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX399.tmp 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX40D.tmp 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\crashreporter.cab 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.cab 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX157.tmp 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.cab 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.cab 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.cab 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCXD1.tmp 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCX1A9.tmp 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX2C0.tmp 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ExtExport.cab 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX48F.tmp 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCX4F1.tmp 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX303.tmp 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.cab 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX366.tmp 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.cab 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCX178.tmp 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX3EC.tmp 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX41F.tmp 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX156.tmp 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX29C.tmp 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iexplore.exe 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\readme.1xt 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ieinstal.exe 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX3FD.tmp 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\dotnet.cab 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX278.tmp 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX314.tmp 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iexplore.cab 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.cab 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.cab 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome.cab 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.cab 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.cab 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX388.tmp 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX3D9.tmp 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX103.tmp 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_500033b49f360c6b1367f27099108a24_elex_rhadamanthys_smoke-loader.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3544
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 335KB
- SHA256 4c149bda9a6aea53a0761e29a46cc95f09ec3077765f83cfb3bca60951040616
- MD5 148155b97da965f78ce038cd8fbfe51d
- SHA1 549401d91434f2f8c133ce8befded83d3a88bfbf
- SHA512 9769503bbddeeb86ef0a1d89f608e41fe954e06534d2cff0b36251e497b2f1cab66f294e288535176677e29014abb43c4bc3cb70b006512d1071eb2299a94b84
- SSDEEP 6144:dFlKgzelZNQSBQGH/CSpWqTvoAXjiU4bz:6fBQGH6SfboAX+U4
- TLSH T1BE7401817DA3D8B3D041493188A6CBA1973B6D13AA65D203FB9D0F4B2FB13D49B7A351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\RCX28A.tmp
- Size 288KB
- SHA256 c384dc0448cc6e8e4bf83844c439f3a63be0967607f49bcb5b0261fbd81ab652
- MD5 bb02cf3e5e487ce8cfef37a324ca1eb1
- SHA1 12f994fbbf8f0d10726f5c823c60325959dfc664
- SHA512 9940aa19f209a50fdca59acf0bc5178443ede0174a092c9a2496c6e05e18b2d24507ced176b8f1fa1bbef864a4cd2c26c1231f40eab43d97a36dce160e56574b
- SSDEEP 6144:xFlKgzelZNQSBQGH/CSpWqTVoAXjiU4bz:mfBQGH6SfRoAX+U4
- TLSH T1645401917DA2D8B3D041493188A6CFA1973B6D13AA65D203FB9D0F4B2FB13D49B7B241
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome.exe
- Size 1.5MB
- SHA256 817177c0aa8d71feb50674ba04fd9c5887f9895b863a4a35b2a1be2c4efa4d03
- MD5 e89ff1204bf436e819a78c9b15f82c6a
- SHA1 c83ca733338b38039bf8133245d4b67c3075455e
- SHA512 da30a0bbbb2da0b8531e7bf147117ef1b4d0be8e30a92e2f3b7ba8ba08dbe7c7c0837a5910200896fe4589600430ca61d6370ad41c4bec928864c0c11e0d0f44
- SSDEEP 6144:6FlKgzelZNQSBQGH/CSpWqTov04NI1oAXjiU4bz:dfBQGH6Sf00X1oAX+U4
- TLSH T1D165F144BDC3D5B3D402493184A786F04BBF6E07755BE22BFBA86E4B2EF03C81656661
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\RCX3EC.tmp
- Size 288KB
- SHA256 9ee0cc8bd6f2e6f5aabb131cf3d94a0d4ad133c0fcf5df00d7985602dfa6c9c0
- MD5 812e2c268357fb8d6d2258b50edf3033
- SHA1 15ee58a014bd1ff70726cbb03e615bcd2b367a9f
- SHA512 888e5731a3cd927450a87dca2299831c4535d068530ab20adea9569028eb2c04b4389911309c76c3b122bfbca57ee4e26bd8879642c71917a1400f94e849e93e
- SSDEEP 6144:dFlKgzelZNQSBQGH/CSpWqTsoAXjiU4bz:6fBQGH6SfooAX+U4
- TLSH T1015401917DA2D8B3C0419A3188A6CBA197376D139A65D203FBAD1F4B2F713D49B7B301
- MD5 SHA1 SHA512 SSDEEP TLSH