Analysis
- max time kernel
150s - max time network
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/10/2026, 15:01
Behavioral task
behavioral1
Sample
2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe
- Size 323KB
- Sample261006-sd8lcszv8p
- SHA256 8f5a4da12f6a3eff77c0336d1f465fd412e08c30415535cf74760cc812e7eecf
- MD5 1d4f2e144c4253eb69cceec90847728d
- SHA1 0e4c1edfc3db66262b14b27fb068996dc0401ac8
- SHA512 bdc653f03584d7216620ca109ada9b81809faf767d47beb1f852e1fd484394bf9500a0e749bbb816169fec37c1cb0036a360d4390bf8f50127b6feba1b4e89a6
- SSDEEP 6144:PFlKgzelZNQSBQGH/CSpWqTkoAXjiU4bz:gfBQGH6SfIoAX+U4
- TLSH T1466402457D93C4B3D0414D3188E68BE19B7F6C137AA6E11BFB9D0B4B1EB13844BAA361
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000900000001b302-3.dat family_cosmu behavioral2/files/0x000400000001bb2f-86.dat family_cosmu behavioral2/files/0x000300000001bb31-184.dat family_cosmu behavioral2/files/0x000d00000001c50a-188.dat family_cosmu - Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\G: 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\H: 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\J: 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\L: 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\I: 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\K: 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\M: 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\N: 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\O: 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\RCX43D7.tmp 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX4523.tmp 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.cab 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.cab 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX46B3.tmp 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.cab 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iexplore.cab 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX43DA.tmp 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX45BB.tmp 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX4860.tmp 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX440B.tmp 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ielowutil.exe 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\readme.1xt 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX43D9.tmp 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX45CC.tmp 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX45FF.tmp 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.cab 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ieinstal.exe 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.cab 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX484F.tmp 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7zFM.cab 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCX4883.tmp 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX43C7.tmp 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCX445F.tmp 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX45AB.tmp 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX45DD.tmp 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.cab 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.cab 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7z.cab 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCX443F.tmp 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX4520.tmp 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX4547.tmp 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX46A1.tmp 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.cab 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCX4871.tmp 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ExtExport.exe 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX4870.tmp 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7zFM.exe 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX43D8.tmp 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX450F.tmp 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX461F.tmp 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX441D.tmp 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX4533.tmp 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.cab 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-06_1d4f2e144c4253eb69cceec90847728d_elex_rhadamanthys_smoke-loader.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5620
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 335KB
- SHA256 7f0631bac6f9da3eaf868898a7fa99995d5f5deb8e079b892732eefe54c642df
- MD5 4009c79aa67b5831d05499206ecec111
- SHA1 3a890e2b2fb8c293bcebf6545cccc71c3175f2c6
- SHA512 5559e224b88c44c5ff5882faba803bc22865f36bba5ac5dc8e415950ba7f64211ba6e87e4cd584720e2c09cc9fc4455a3cb92afbf85ebaeff140504b4e279900
- SSDEEP 6144:EFlKgzelZNQSBQGH/CSpWqTyoAXjiU4bz:jfBQGH6SfeoAX+U4
- TLSH T1FC74F1457D93C4B3E0414D31C9E68AE14B7E6C037AA6E11BFF5D0B4B1EB13884BA66B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX4620.tmp
- Size 284KB
- SHA256 f273373f84b29431f6b321d2cf962e4927e8dbadf084ce1d6ddc3d8511c3ec86
- MD5 d631f90961723d88ae50edcfc2a07afb
- SHA1 4e2e94155565849f7ef74a7101853808f69f4b03
- SHA512 3bd4119fcde0ba60278b08321ad4cf545049c61a6916db8420f290d2775c5d9d0c13770d677509f9fc3c899d151f5b76124208f78cd834aa62f12184c19eaad7
- SSDEEP 6144:cFlKgzelZNQSBQGH/CSpWqTfoAXjiU4bz:7fBQGH6SfzoAX+U4
- TLSH T1485402457D93D4B3D0414D3188E78BE18B7F6C137AA6E11BFB9D0B4B1EB13884BA6261
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX4621.tmp
- Size 284KB
- SHA256 8d2cbe430d847d7a92e8f490a15aa6e1b79bcb162207e7d24ef0bcbcfd728489
- MD5 d19b56481205aed258979abddd85a793
- SHA1 173705acb56ee64676d9a64624c0f845e166c320
- SHA512 dfe4c50bc8eb814af7e94d54ae7121e66669d6d0d1c19a1d67269f18d79669663e9c4a5b781d0c2e7ac48a709522b698f7d0f4b6512efb8aec8cb0b64b6fee7e
- SSDEEP 6144:UFlKgzelZNQSBQGH/CSpWqTZoAXjiU4bz:TfBQGH6Sf9oAX+U4
- TLSH T1305402457DA3C4B3D0414D3188E68BE19B7F6C137AA6E11BFB9D0B4B1EB13844B6A361
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\RCX4520.tmp
- Size 284KB
- SHA256 c9cc4acad09232c513f12df23a44be5b8f5c5590ab9870fe80e1cc76ff55bc59
- MD5 98c539bb48fd214ad2b90b19b3fe6287
- SHA1 c7e947a7048247ebbebce5bf91267171862b6ae7
- SHA512 37a30aec7868735a5f3ce8218cb3ce79d07bcf2e24702c7fcddb3d1f5fe67e9c5af94e118968a13ddc430a1c08f20f57e4f5d85fbd57a1d52f12f8d02e18147a
- SSDEEP 6144:QFlKgzelZNQSBQGH/CSpWqTAoAXjiU4bz:nfBQGH6Sf0oAX+U4
- TLSH T1BB54F1457D93C4B3D0414D31C9E68BE14B7E6C037AA6E11BFB5D0B4B1EB13884BAA6B1
- MD5 SHA1 SHA512 SSDEEP TLSH