Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/09/2026, 20:01
Behavioral task
behavioral1
Sample
2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe
- Size 284KB
- Sample260916-yrw3davfja
- SHA256 9f92ccb8ec7108dcc9dc5022a1e1c6d71700d89cb91325ef96ee1450eb0abb2d
- MD5 7ea1a67218c3bc53b8ffbe810896b13a
- SHA1 fec410dd14a3f2554248f3e5e99c4795a528c7db
- SHA512 1505204d4959f83242ac5b8974267195a32311e45494fcac6b1e050b65ad5c894917919120cf6b3f293e7e56edc51c813d83f0cb60ac3ae1af818d2bbcc32995
- SSDEEP 6144:gFlKgzelZNQSBQGH/CSpWqTsoAXjiU4bzN:XfBQGH6SfQoAX+U49
- TLSH T1D55402457D93C4B3D0414D3188E68BE18B7F6C137AA6E11BFB9D0B4B1EB13844BAA761
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000e00000001c47b-6.dat family_cosmu behavioral2/files/0x000d00000001c49b-81.dat family_cosmu behavioral2/files/0x0006000000018964-192.dat family_cosmu behavioral2/files/0x000d00000001c4ac-251.dat family_cosmu - Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\M: 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\N: 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\O: 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\D: 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\H: 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\J: 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\K: 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\L: 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\G: 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCXE4BB.tmp 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCXE4CD.tmp 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.cab 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXE379.tmp 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.cab 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCXE1AA.tmp 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.cab 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.cab 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCXE457.tmp 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.cab 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\readme.1xt 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7z.cab 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCXE143.tmp 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCXE1BA.tmp 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome.cab 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ielowutil.exe 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCXE4CC.tmp 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXE365.tmp 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXE3E1.tmp 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iediagcmd.cab 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCXE510.tmp 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.cab 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCXE535.tmp 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCXE144.tmp 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.cab 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCXE166.tmp 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXE39C.tmp 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.cab 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCXE155.tmp 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7z.cab 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXE377.tmp 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXE3D0.tmp 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXE3BD.tmp 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.cab 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCXE156.tmp 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXE376.tmp 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXE3CF.tmp 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCXE20B.tmp 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXE3AD.tmp 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.cab 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.cab 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCXE403.tmp 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ieinstal.cab 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCXE1CC.tmp 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.cab 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-16_7ea1a67218c3bc53b8ffbe810896b13a_elex_rhadamanthys_smoke-loader.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2744
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 322KB
- SHA256 3089283bb28c5bf88ae10c788c406965ffcea1d2b78d5155e3bc85929bf40554
- MD5 c748ecd3c5bd34a147b38f9d094ec0f7
- SHA1 bbc1b97867688be4216eb3cf92fb68fdd3069708
- SHA512 8225cd1c8bda91f9b8b1cea7c148b6dbc69daaa0dcb6d682b9cbe1683ccc2256d0c24aaf003ffaa28d4aee985c8a0bbafdb92fc5de3ff7cee42f85df6a03c082
- SSDEEP 6144:xFlKgzelZNQSBQGH/CSpWqTyoAXjiU4bz:mfBQGH6SfeoAX+U4
- TLSH T11B64F1457D93C4B3E0414D31C9E68AE14B7E6C037AA6E11BFF5D0B4B1EB13884BA66B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\RCXE379.tmp
- Size 284KB
- SHA256 1458b5128c34f41d577cc7073a1e7af165093e1e02f0b1bdedbff057ce77a0bd
- MD5 720aeb60d8f91cfcda789464d4021a87
- SHA1 46210f0de113bf9476c74ecc459dab479b6d4df7
- SHA512 7aa38330c27a31683b0124020485064eb8e9e96456d5841273b3cf51b6d900a751d11f26fdd1ea920111406548da53aa5774881dc8c43e1a7b668d6218f54d6d
- SSDEEP 6144:9FlKgzelZNQSBQGH/CSpWqTRoAXjiU4bz:afBQGH6SfdoAX+U4
- TLSH T1D254F1457D93C4B3D0414D31C9E68BE14B7E6C037AA6E11BFB5D0B4B1EB13884BAA6B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\RCXE4BC.tmp
- Size 284KB
- SHA256 23f53fc4c14b3292de7952cd1631fa9f2b3ea191a71bb17f4d2b6ae640b9660d
- MD5 aa418bdc7be6f6d1152fe9be6c319ac3
- SHA1 6729f5654fe14f38d3c410677abb4bad41a92560
- SHA512 96269fad1b331225c6d9dbb22a30509a7ee7e999312ecfd32f8880bc0f963ba5f72711dddd160d2688e4f9c238beba468eeaf0c4de3bd98e70c0affe15ada160
- SSDEEP 6144:JFlKgzelZNQSBQGH/CSpWqTEoAXjiU4bz:+fBQGH6SfwoAX+U4
- TLSH T1945402457D93C4B3D0414D3188E68BE18B7F6C137AA6E11BFB9D0B4B1EB13844BAA261
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe
- Size 322KB
- SHA256 b335a1856ef47c816f7cba0c6616c0d0ec41bf8f1dcff6f16ea3087874f79402
- MD5 fc0433a8debf5e1f272c841b956b33ff
- SHA1 1ed51872e52614c9613071c9c9e86fef2fc1852f
- SHA512 4d194028124af74c20c750b6a784b6777bdb2712b671780d5cdf4118268ad2629bb32092bc77368ecb40eac448b42ec25b704de851c581a7edf93817265d7ea8
- SSDEEP 6144:NFlKgzelZNQSBQGH/CSpWqTjoAXjiU4bz:KfBQGH6SfnoAX+U4
- TLSH T1A86402457D93C4B3E0414D3188E68BE18B7F6C137AA6E11BFB5D0B4B1EB13884BA6671
- MD5 SHA1 SHA512 SSDEEP TLSH