Analysis
- max time kernel
148s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/09/2026, 09:38
Behavioral task
behavioral1
Sample
2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe
- Size 284KB
- Sample260908-lmax5aef26
- SHA256 aeedea2a0903b5f1fd3e7ea162b4be2b8b47796bd2eef238531ec4c6bbe70418
- MD5 9bb2cc7ac00345d3d570106b6cc841ae
- SHA1 2e3e8fbc9044a90877f8de51258053847a90ae5a
- SHA512 bbb40a3b6d5d6a8b8c8c857af9b0380ff4a4d9b226f738a31d9c15896fbb82a0713f4d4fb7f1186ad54bc4fa0404f96a31e9056e6cca25df630c61e58cf9f885
- SSDEEP 6144:LFlKgzelZNQSBQGH/CSpWqTFoAXjiU4bzN:0fBQGH6SfxoAX+U49
- TLSH T1055402457D93C4B3D0414D3188E68BE19B7F6C137AA6E11BFB9D0B4B1EB13844BAA361
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000d00000001c677-6.dat family_cosmu behavioral2/files/0x000d00000001c681-81.dat family_cosmu behavioral2/files/0x0005000000018973-192.dat family_cosmu behavioral2/files/0x000300000001b91b-251.dat family_cosmu - Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\I: 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\L: 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\M: 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\N: 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\O: 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\J: 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\K: 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\D: 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\G: 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Mozilla Firefox\default-browser-agent.cab 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXE442.tmp 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXE487.tmp 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.cab 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.cab 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCXE6E1.tmp 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.cab 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iexplore.exe 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.cab 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.cab 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCXE297.tmp 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCXE4FA.tmp 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iediagcmd.cab 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCXE6AE.tmp 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXE420.tmp 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.cab 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ielowutil.cab 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCXE702.tmp 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7z.cab 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXE485.tmp 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.cab 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCXE68B.tmp 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCXE4BA.tmp 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.cab 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCXE724.tmp 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.cab 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.cab 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCXE2A9.tmp 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7zFM.cab 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCXE2EB.tmp 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXE41F.tmp 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCXE679.tmp 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCXE69D.tmp 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCXE713.tmp 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCXE30D.tmp 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ExtExport.cab 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.cab 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.cab 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCXE2BA.tmp 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCXE33F.tmp 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.cab 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ielowutil.exe 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-07_9bb2cc7ac00345d3d570106b6cc841ae_elex_rhadamanthys_smoke-loader.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4680
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 335KB
- SHA256 c60cd0622627c31c2fac6aa6469960a73b88094069d0b9e416283eab446c35c1
- MD5 7081c131d5650ef37dcf4651212ee9a2
- SHA1 4c5cc02d583aeac9ab47f91b62bcd2c87eb85fe0
- SHA512 23bab8154cf89e6ba4758890b21ce0a486a69483886f5d68f1851ecfca8ee6cbc9fb460381fd9c4fa353404edcf35bb3c2eeece3f7e441c8afc4eb5f4e87cc23
- SSDEEP 6144:KFlKgzelZNQSBQGH/CSpWqTyoAXjiU4bz:NfBQGH6SfeoAX+U4
- TLSH T1B774F1457D93C4B3E0414D31C9E68AE14B7E6C037AA6E11BFF5D0B4B1EB13884BA66B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\RCXE420.tmp
- Size 284KB
- SHA256 dde310f99429237986ec2f4ddeba619e8fdc2ee1ead88a4dfc0e6e19781f41e3
- MD5 049398affc8bb0dac7476ed0526e2e6c
- SHA1 5ad4f9c17ca4f6a1474283277a386d07d47a07ab
- SHA512 27f96d72f781fa8457f96fbd6dd014ccebff63732785a1aac2bea56536346c53a435b391faa73ab7b7cadf1b6c8e4b094a068e7a6cfd7f711aede51687aeae54
- SSDEEP 6144:mFlKgzelZNQSBQGH/CSpWqTRoAXjiU4bz:BfBQGH6SfdoAX+U4
- TLSH T1AC54F1457D93C4B3D0414D31C9E68BE14B7E6C037AA6E11BFB5D0B4B1EB13884BAA6B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\RCXE68C.tmp
- Size 284KB
- SHA256 405c32c018682c0eaf0fbf64d8a196ce76acbefcffb2acefe8329a4edb15bac2
- MD5 880e2b80e3d5439674e604fe12677fb1
- SHA1 a52da64be867e28ee8fe69d3650d3117687e713f
- SHA512 7cdb8fc6ed246e70ac197e6a057147a712cdfca02dcf740c2a1453ba9a26c8992ee57fe4d50cc93243db36a0bd1274fb80f45a4c192a4664c207d8112f9553a7
- SSDEEP 6144:KFlKgzelZNQSBQGH/CSpWqTEoAXjiU4bz:NfBQGH6SfwoAX+U4
- TLSH T1595402457D93C4B3D0414D3188E68BE18B7F6C137AA6E11BFB5D0B4B1EB13844BAA261
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe
- Size 359KB
- SHA256 c3e1d96684c53d43e54ca483271e6189e129bcf0480eaa96251e7ffdae887b53
- MD5 2621c232535c3ef6797291f07b7d8352
- SHA1 e18775b218fea01924b8936dab8fe23ca73f9388
- SHA512 8e8d4225d0d89302081016744c2d3d50e603b78009af8ecc1436e6e9e9c501cdd80f758c94992776916ef88d04a9c948d9008623c00aafcc40ad6513dc8cdc82
- SSDEEP 6144:CFlKgzelZNQSBQGH/CSpWqT/UjD51oAXjiU4bz:FfBQGH6SfLUjD51oAX+U4
- TLSH T1B174F1413E93D4F3D44149318CA78FB19B3B7C23BAA5D207FB993B4B9EB13805A26255
- MD5 SHA1 SHA512 SSDEEP TLSH