Analysis
- max time kernel
148s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/09/2026, 07:50
Behavioral task
behavioral1
Sample
2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe
- Size 284KB
- Sample260924-jpmzcsv18n
- SHA256 d6d7d664de53e5cb910e67378b7fc0110cb97241db5f39d2b7e1997ede364f8d
- MD5 5fc501460f03e9589136273d6903215c
- SHA1 fc3e08490d704220ff4b99133bb62a038b9bbc72
- SHA512 851329ff18e2064b5ab0466ab7e3a5bf031ff0bd6a94b055ed13b5e22679c1df5a2a4ced22de9b6e320511e787635d8e761819367881123e3c9d7dab41946769
- SSDEEP 6144:IFlKgzelZNQSBQGH/CSpWqT6oAXjiU4bzF:/fBQGH6SfOoAX+U41
- TLSH T1545402457D93C4B3D0414D3188E68BE19B7F6C137AA6E11BFB9D0B4B1FB13844BAA261
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Cosmu payload 3 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000e00000001c521-6.dat family_cosmu behavioral2/files/0x000400000001baf5-81.dat family_cosmu behavioral2/files/0x0005000000018978-192.dat family_cosmu - Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\G: 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\K: 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\N: 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\D: 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\H: 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\I: 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\J: 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\L: 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\M: 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.cab 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.cab 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX514D.tmp 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7z.exe 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7zFM.exe 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\dotnet.cab 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCX4DA6.tmp 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.cab 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX50C8.tmp 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\RCX51E2.tmp 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX505F.tmp 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX4E74.tmp 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX512A.tmp 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ExtExport.cab 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ExtExport.exe 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iexplore.cab 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7z.cab 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX4D31.tmp 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX4D64.tmp 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX4E98.tmp 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX519F.tmp 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.cab 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX50B5.tmp 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX4D1E.tmp 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX4D20.tmp 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX518D.tmp 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX51C2.tmp 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX4D52.tmp 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ielowutil.cab 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ielowutil.exe 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX51AF.tmp 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX4D53.tmp 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX5090.tmp 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.cab 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX5108.tmp 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.cab 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.cab 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.cab 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\dotnet.exe 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX4E75.tmp 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX51F4.tmp 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX5205.tmp 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.cab 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX4E76.tmp 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX50F7.tmp 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iediagcmd.cab 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-23_5fc501460f03e9589136273d6903215c_elex_rhadamanthys_smoke-loader.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5312
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 321KB
- SHA256 6e60bea75988007da09424f2df3920994cb4b36487e0632e98c4680c4cd5673d
- MD5 e8ce543b63aaeca18bdf39c1e91171cd
- SHA1 c536358fb78dc72d295ac34f7537e8ece0eb088b
- SHA512 96e779d738406d819e9297b02e28bd20e361afe5063c3807740b7c30f6052566da4671fa0e862efe3201860c3bf19f1f45e74b910e2688113c565f096080258a
- SSDEEP 6144:3FlKgzelZNQSBQGH/CSpWqTyoAXjiU4bz:ofBQGH6SfeoAX+U4
- TLSH T15464F1457D93C4B3E0414D31C9E68AE14B7E6C037AA6E11BFF5D0B4B1EB13884BA66B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\RCX4E87.tmp
- Size 284KB
- SHA256 d5f11a7268f50bbadc2825515b2ef59ef20faffca40908be22559803af4aae30
- MD5 ee68bcb26b050c2d65b9d70aa18dd458
- SHA1 e211329c27ca5bc3330f7d879009898cbfd97f8f
- SHA512 3aa7b08875f7d2c4f0b42272ba0576c5c814399e7910ae1b8892931668a496c91aaed89f352d0035d1a7b1337f5959331f9e1e53f1e061bdb49f396418433f09
- SSDEEP 6144:TFlKgzelZNQSBQGH/CSpWqTRoAXjiU4bz:8fBQGH6SfdoAX+U4
- TLSH T1B354F1457D93C4B3D0414D31C9E68BE14B7E6C037AA6E11BFB5D0B4B1EB13884BAA6B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\RCX519F.tmp
- Size 284KB
- SHA256 8ed95867bfe2cf36c308edbddfb07a9e3e09c30f42cb85dd43c9ca11952d367a
- MD5 6fed2016872422e25e844ba44c83e688
- SHA1 45e1c67ccb3a93205ce4872717b093f8ffcea710
- SHA512 0e59ed7b24b07e962c046816e57f61a6d14042ae601ef00a676d9522cebbd31195b63ac928df5b468508771ff445a884a5ca6334184e2dd4a704935de62b91e3
- SSDEEP 6144:HFlKgzelZNQSBQGH/CSpWqTEoAXjiU4bz:YfBQGH6SfwoAX+U4
- TLSH T1C25402457D93C4B3D0414D3188E68BE19B7F6C137AA6E11BFB9D0B4B1EB13844BAA261
- MD5 SHA1 SHA512 SSDEEP TLSH