Analysis
- max time kernel
148s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/09/2026, 13:23
Behavioral task
behavioral1
Sample
2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe
- Size 284KB
- Sample260922-qna2qsfc56
- SHA256 075cc603ae5f75c3f2d4ec5b363231825321d5269db2214d65bb47d9ce485c31
- MD5 4d4ccf367597648ee016995a3638f4ae
- SHA1 9173862a76751aadcbe9110cb2b2b95de91e9051
- SHA512 1cef7dfc553a223b04020f091fecfaaf96ca3838176b7a0d2684bb03d29af12952b300b0843ea66b65a1517ee2ac6642f63ef3811f78d63a064d16d1ebd4d908
- SSDEEP 6144:BFlKgzelZNQSBQGH/CSpWqTaoAXjiU4bzF:WfBQGH6SfuoAX+U41
- TLSH T1555402457D93C4B3D0414D3188E68BE19B7F6C137AA6E11BFB9D0B4B1FB13844BAA261
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000e00000001c588-6.dat family_cosmu behavioral2/files/0x000c00000001c58d-23.dat family_cosmu behavioral2/files/0x000c00000001c593-81.dat family_cosmu behavioral2/files/0x0005000000018977-192.dat family_cosmu - Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\K: 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\L: 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\M: 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\O: 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\D: 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\G: 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\H: 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\N: 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\I: 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX2A5.tmp 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX2C6.tmp 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.cab 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCXC0.tmp 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX227.tmp 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX24D.tmp 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7zFM.cab 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX24E.tmp 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.cab 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.cab 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX215.tmp 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ieinstal.cab 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7z.cab 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCX124.tmp 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX3AD.tmp 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCX3F2.tmp 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7z.exe 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX216.tmp 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX2C5.tmp 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX24F.tmp 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX228.tmp 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX23B.tmp 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.cab 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.cab 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.cab 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCXAE.tmp 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX36D.tmp 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX250.tmp 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX271.tmp 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCX403.tmp 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.cab 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX2D8.tmp 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.cab 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCX156.tmp 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.cab 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.cab 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX2E8.tmp 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX2E9.tmp 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iediagcmd.cab 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.cab 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX3CE.tmp 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\dotnet.cab 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCX136.tmp 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX292.tmp 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.cab 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX34C.tmp 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-21_4d4ccf367597648ee016995a3638f4ae_elex_rhadamanthys_smoke-loader.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1072
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 331KB
- SHA256 34d334f6270180e531cc504ebc88870e4f5f6c3f10056873a9b3862bf19575eb
- MD5 e41209b71840d5b9878414b403eb9a7d
- SHA1 4e0fb33b86dc0f92bab6466dcf8e017948c200d0
- SHA512 20e2ccbf06dcd6407c3a9921b1c5e06d9d14b3aac70168ee67c5104b0838ed729504b8391dd5956d4a6e247184295710774ac946f42bf8b39a8303d3e1081567
- SSDEEP 6144:yFlKgzelZNQSBQGH/CSpWqTyoAXjiU4bz:VfBQGH6SfeoAX+U4
- TLSH T14A74F1457D93C4B3E0414D31C9E68AE14B7E6C037AA6E11BFF5D0B4B1EB13884BA66B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 339KB
- SHA256 4cedb0c546014833e0993c46e95799fc13300df2cbe436401482258172ad6424
- MD5 276c2b6a76254ef8684c30560cec940b
- SHA1 4382aab056ad8b3395d09a28bafc90a7e631218c
- SHA512 83f714a195d386409b6d655681f961c42ef7a9cbd532bb22cae785b9f53df1971fb408dcd1ee9cd1dedb387ec2635a737164262455a16f58b3f3aec00727cbaf
- SSDEEP 6144:iFlKgzelZNQSBQGH/CSpWqTvwYoAXjiU4bz:lfBQGH6Sf0YoAX+U4
- TLSH T1EA74F1443A9FC7B3D3C24930C8AEBAD147BA7C2F6756D13BF7580B0B1EB12885666251
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\RCX227.tmp
- Size 284KB
- SHA256 6ebcda9fdcf92a42724e07638353b86b96bc3d1cd036ea900028c0e572d4d3e6
- MD5 605ed6cad3b41d861b63d7f6666751e5
- SHA1 aba06d3b243d67f6193d49450f68d6f5081deae4
- SHA512 e02f7fb76180ab9f2ce4e82a100e71d947151c5d0e0d8fd09174f89d38317a4653a0644632365b2466345819dd33bb49d9a6b8281a105c0b44d49374ab54eaa2
- SSDEEP 6144:OFlKgzelZNQSBQGH/CSpWqTRoAXjiU4bz:pfBQGH6SfdoAX+U4
- TLSH T11F54F1457D93C4B3D0414D31C9E68BE14B7E6C037AA6E11BFB5D0B4B1EB13884BAA6B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\RCX32C.tmp
- Size 284KB
- SHA256 7fb3831849538f2f4fe88bb173e8b7f209d5823cb02ea5b91f304dd4851999c1
- MD5 32f047d974dcd9c0fb365fc107c998fb
- SHA1 af02e572a01501494541214ab72ef709775e94d7
- SHA512 b6000f39f9f061a167a7b7003af0bdc1ded540e5911d66a4dddd71012f38936c73a55b030eb8310474e1d53970e86209c154aeba510aeaba4f7166e3edbd08fc
- SSDEEP 6144:SFlKgzelZNQSBQGH/CSpWqTEoAXjiU4bz:1fBQGH6SfwoAX+U4
- TLSH T1005402457D93C4B3D0414D3188E68BE19B7F6C137AA6E11BFB5D0B4B1EB13844BAA261
- MD5 SHA1 SHA512 SSDEEP TLSH