Analysis
- max time kernel
148s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/10/2026, 19:23
Behavioral task
behavioral1
Sample
2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe
- Size 1.5MB
- Sample261003-x3s97axtbs
- SHA256 ca438ce3509c24933fb95088b2d87338b3e9c0bd7322469606db504d6bdfe276
- MD5 b472bf7b47097ebe910a2dbe39085cfa
- SHA1 2425b3c3a808a1cd637c83f85e9eb4cd3cb6083e
- SHA512 de520687f7292857523c55e495f16fe50a4d6d0674a36ed0943bd658f45584d00a85524b1102ce6472088761129621bf802898b2ff527efbbb97db6171088eee
- SSDEEP 6144:oFlKgzelZNQSBQGH/CSpWqTPueF/mNyBXoAXjiU4bz:ffBQGH6SfKCBXoAX+U4
- TLSH T16065CFB27B92C66BD4E7C23DB4458553A7F29B024D13926397A0EF3DCA392814DDCC42
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x002200000001c322-3.dat family_cosmu behavioral2/files/0x000400000001bb65-86.dat family_cosmu behavioral2/files/0x000300000001bb67-184.dat family_cosmu behavioral2/files/0x000f00000001c4f9-188.dat family_cosmu - Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\K: 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\L: 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\N: 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\G: 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\H: 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\M: 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\O: 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\D: 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\I: 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\RCX4292.tmp 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCX41BF.tmp 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX4403.tmp 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX4139.tmp 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX417D.tmp 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.cab 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.cab 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX43F3.tmp 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX4404.tmp 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX42DA.tmp 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX42EB.tmp 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.cab 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.cab 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX417C.tmp 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX42FC.tmp 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX43E1.tmp 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.cab 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ExtExport.exe 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ieinstal.cab 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iexplore.cab 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX4448.tmp 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX4458.tmp 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX4126.tmp 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.cab 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX416B.tmp 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.cab 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX43D0.tmp 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX42C8.tmp 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ExtExport.cab 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.cab 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.cab 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX426D.tmp 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX4391.tmp 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7zFM.exe 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX427F.tmp 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.cab 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.cab 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCX446A.tmp 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.cab 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.cab 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX433C.tmp 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.cab 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX435F.tmp 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX4426.tmp 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX42B6.tmp 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7z.exe 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX4138.tmp 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_b472bf7b47097ebe910a2dbe39085cfa_elex_rhadamanthys_smoke-loader.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4312
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 327KB
- SHA256 cdaddbfb1af6454c83a117dc696ab9978daf96dd3210d2ac479e0a6b397c8899
- MD5 424390ec377dbaf677ed76a354db3429
- SHA1 6304da67139818ecdd55f325c66e0fb9b706087c
- SHA512 984db252659453b36df4b0c072cdb5fe9ae65dc15fb4dba62210cb159a1987ad60cee46ab2c6bea7c399596973be8ffb4194f7f69fb59dfe7265130d1a77764b
- SSDEEP 6144:AFlKgzelZNQSBQGH/CSpWqTyoAXjiU4bz:3fBQGH6SfeoAX+U4
- TLSH T14364F1457D93C4B3E0414D31C9E68AE14B7E6C037AA6E11BFF5D0B4B1EB13884BA66B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX4390.tmp
- Size 284KB
- SHA256 9ee58cf36002845ade792723a0addb7d5d645ee46f5b1ce4bc9751ebd9cd07e5
- MD5 400b69ab3ecf723bd9f0035efebfa09f
- SHA1 f63cc0ff3a7e28b06f530afc21cb200259dfdc75
- SHA512 a89a1a4500cc7f5cab8951e1f78fbc2e2d7dbb049a44731e5c9545e8513e8518f6ff2098538168e6db646496b17bd7199ac9fcf7b54b5235de792b031e4bfd9c
- SSDEEP 6144:YFlKgzelZNQSBQGH/CSpWqTfoAXjiU4bz:vfBQGH6SfzoAX+U4
- TLSH T1445402457D93D4B3D0414D3188E78BE18B7F6C137AA6E11BFB9D0B4B1EB13884BA6261
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX4391.tmp
- Size 284KB
- SHA256 3a8175a390af784e8430a9dfae228cda658ad972f3f9a161dd6f6974f412700f
- MD5 3c139ca9a08eac76e1660b08025ab1db
- SHA1 045efeeb7481aad480d21e23a2ca2723cad7344d
- SHA512 0e3aeacadde8b2d0029ee163877b9cf5efbce357aecd3ace4301084c08e443e9c95d7a911d67513b343ad846ca5c358bd3dd23187e683e599ec472007ece235e
- SSDEEP 6144:AFlKgzelZNQSBQGH/CSpWqTZoAXjiU4bz:3fBQGH6Sf9oAX+U4
- TLSH T1C25402457DA3C4B3D0414D3188E68BE19B7F6C137AA6E11BFB9D0B4B1EB13844B6A361
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\RCX4290.tmp
- Size 284KB
- SHA256 e7d7f063fa964c6c4792a479d8e935b9e3748ced2a1eb94c1b1b05d39cce1fbd
- MD5 f51c2c76673bcc4b85fe46f50e2e541e
- SHA1 003ef1ac5aaa196faabb4871a791235a7403a958
- SHA512 0e73c5674ca066eed52c0b5416c53f31b12470a3f05051bb045981084dbfbea76765367e811510ffedf8513c98963ade83f87a35aab948f545d1dcc1c4c862aa
- SSDEEP 6144:sFlKgzelZNQSBQGH/CSpWqTAoAXjiU4bz:rfBQGH6Sf0oAX+U4
- TLSH T1BA54F1457D93C4B3D0414D31C9E68BE14B7E6C037AA6E11BFB5D0B4B1EB13884BAA6B1
- MD5 SHA1 SHA512 SSDEEP TLSH