cosmu | 803f52f1d318e164a173207247d1d466f8a746b8af3ab18b90ad248964fd8e48

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 21:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe
Size 288KB
Sample261002-1vy29atfle
SHA256 803f52f1d318e164a173207247d1d466f8a746b8af3ab18b90ad248964fd8e48
MD5 fa04f59e063229cf0258be6c67c05d3d
SHA1 aa1e0e0a5e9bd513ad528de1c03cd7285a640fa8
SHA512 fedbabfcea9f14d2961b9ed1aaf4aee66dd179920439b9da552900e06903753b56d60c614cf747e0e810785d1f381de297853c4568856f5edc2b6db8984cc6c2
SSDEEP 6144:xFlKgzelZNQSBQGH/CSpWqTtoAXjiU4bzV:mfBQGH6SfRoAX+U4l
TLSH
T1835401917DA2D8B3C0419A3148A6CBA197376D139A65D203FBAD1F4B2F713D49B7B302
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery cosmu worm

Malware Config

Signatures

Family: Cosmu
Cosmu is a Windows worm written in C++.
worm cosmu

Detects Cosmu payload 4 IoCs

Cosmu is a worm written in C++.

resource	yara_rule
behavioral2/files/0x000300000001b2cd-3.dat	family_cosmu
behavioral2/files/0x000d00000001c4c6-86.dat	family_cosmu
behavioral2/files/0x000300000001bb41-184.dat	family_cosmu
behavioral2/files/0x000d00000001c4ca-188.dat	family_cosmu

Enumerates connected drives 3 TTPs 10 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\N:	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\O:	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\I:	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\J:	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\K:	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\L:	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\D:	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\G:	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\H:	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCXAAA1.tmp	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCXAB40.tmp	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCXAB41.tmp	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.cab	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\RCXA946.tmp	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\RCXA959.tmp	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCXAB0D.tmp	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\RCXABC6.tmp	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\dotnet\RCXA9DF.tmp	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Mozilla Firefox\crashreporter.cab	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCXAB71.tmp	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCXAAD6.tmp	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7z.cab	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCXAAD9.tmp	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\helper.cab	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\RCXA97D.tmp	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.cab	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCXAAF9.tmp	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.cab	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\RCXAC59.tmp	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Internet Explorer\iexplore.cab	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.cab	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.cab	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.cab	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\readme.1xt	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCXAAFA.tmp	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.cab	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Internet Explorer\iediagcmd.cab	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Internet Explorer\ieinstal.cab	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Internet Explorer\ieinstal.exe	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCXAB93.tmp	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCXAAA0.tmp	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCXAB0B.tmp	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCXA9F0.tmp	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\RCXAC48.tmp	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\dotnet\RCXA9CD.tmp	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCXAAC5.tmp	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.cab	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Mozilla Firefox\default-browser-agent.cab	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\RCXAC6C.tmp	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCXAAA2.tmp	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCXAB73.tmp	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\dotnet\dotnet.cab	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCXAAD7.tmp	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-02_fa04f59e063229cf0258be6c67c05d3d_elex_rhadamanthys_smoke-loader.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 324KB
SHA256 c4427da37c0da5fa7777976ed21e4f8049801558a44054d852c525a4ae397ce1
MD5 d483f0c553affeb52304ea82d8fdda99
SHA1 5d00ec5bfc77b6d3c559222714bbdad87573428c
SHA512 ef4477c0d38cab7e5279fb56044ffd9ea08657da162c30689422957e0de6239abd62225dcd7b44d5d4eb6d9b452d2919379cd30ad778ed76f4002560c2045452
SSDEEP 6144:OFlKgzelZNQSBQGH/CSpWqTvoAXjiU4bz:pfBQGH6SfboAX+U4
TLSH
T1CE6401817DA3D8B3D041493188A6CFA1973B6D13AA65D203FB9D0F4B2FB13D49B7A251
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXAB72.tmp

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCXAB72.tmp
Size 288KB
SHA256 4358a0fcd16bfe67f750b41dec4ac8e6e7c3c9384c0d467ef0a75cd9a30d9a83
MD5 0068aac49c491a0205ae8dbe5ed05690
SHA1 fad1fc048a6cd09c32858b1d42fe403315d5f1e5
SHA512 6f7e65af657c4e6dcda6216b5d934ce90e9024faf4f60f231a15706208255b4923f77223b8dd0e82da7a0d6f7d01dc8a72bc3921b871d2557ff39ff709090620
SSDEEP 6144:mFlKgzelZNQSBQGH/CSpWqTjoAXjiU4bz:BfBQGH6Sf3oAX+U4
TLSH
T1F05401817DA2D8B3C4414A3288A78FA197376D139A65D203F7AD1F4B2F713D49B7A205
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXAB73.tmp

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCXAB73.tmp
Size 288KB
SHA256 51d1bd5a7786b569c7d19b814cfc99a09b636ca89e9f55f4a7bce3934661a3dd
MD5 6e515d9ce0b84bf9e2f3bdcfdbc8dde1
SHA1 6d06230bae993d08a897d66788887064ffa7aea9
SHA512 59ee2af8ed09f66b6510078694b0825d2afca7ad77ce1a7900deb286eddc4fda67124929faae574a6586a265fa9c0bbd1ab5b7fa1ede322be066e1271f457ae5
SSDEEP 6144:2FlKgzelZNQSBQGH/CSpWqTSoAXjiU4bz:xfBQGH6Sf+oAX+U4
TLSH
T1DB5401917EA2D8B3C0419A315CA68BA197377D139A65D203B7AD1F4B2F713D09B7A302
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXAAA0.tmp

Path C:\Program Files\Google\Chrome\Application\RCXAAA0.tmp
Size 288KB
SHA256 ebcc771ee019d776ae0fb6d9e118f499b7f01422e739f8abb77bd44bfc0584ec
MD5 d0e4fbe0a1b4c8859f98c8ca2cdc3911
SHA1 620e317202068528f5bc42ff9d6eb8dc1501b617
SHA512 b99eca20baf8c75cef00adf933b5b4975fdd16bb3272bce66d8739f5480de697f16080b2508c13aeb4b6898088233f0f3994c60b9e04d8502b14e5d41a8df4ed
SSDEEP 6144:iFlKgzelZNQSBQGH/CSpWqTYoAXjiU4bz:lfBQGH6Sf8oAX+U4
TLSH
T1025401917DA2D8B3D041493188A68FA1973B6D13AA65D203FB9D0F4B2FB13D49B7B341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads