cosmu | 74ce830d064c77acbe83addf83608579b43b86e394016f53c2deec341fdd0391

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/10/2026, 19:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe
Size 1.5MB
Sample261006-ybmtrsty3r
SHA256 74ce830d064c77acbe83addf83608579b43b86e394016f53c2deec341fdd0391
MD5 91457549300ebc927f112f0dbe01535e
SHA1 b09caf6aef3781d4e31dbe76a6225826c6bc9433
SHA512 7beb06e3dabff0a8339343f32c50073793134305e782e25d5d23b7d6f5c4757d3af12110e54ecb6cdfcb3da607714a5a47a588fbb97d8bd982f757c3c629373d
SSDEEP 6144:4FlKgzelZNQSBQGH/CSpWqTeoAXjiU4bz:PfBQGH6SfioAX+U4
TLSH
T1BF7502457DA3D4B3D0414D3188E68BE18B7F6C137AA6E117FB9D0B4B1EB13844BAA361
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery cosmu worm

Malware Config

Signatures

Family: Cosmu
Cosmu is a Windows worm written in C++.
worm cosmu

Detects Cosmu payload 5 IoCs

Cosmu is a worm written in C++.

resource	yara_rule
behavioral2/files/0x000300000001b2cd-3.dat	family_cosmu
behavioral2/files/0x0004000000019c50-36.dat	family_cosmu
behavioral2/files/0x000d00000001c4c7-87.dat	family_cosmu
behavioral2/files/0x000300000001bb41-185.dat	family_cosmu
behavioral2/files/0x000d00000001c4cb-189.dat	family_cosmu

Enumerates connected drives 3 TTPs 10 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\L:	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\N:	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\G:	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\H:	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\I:	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\J:	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\K:	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\M:	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\O:	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCXB074.tmp	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.cab	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\RCXB203.tmp	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\RCXB236.tmp	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\RCXADF3.tmp	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCXB061.tmp	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCXB16D.tmp	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\RCXB1E1.tmp	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\RCXADD0.tmp	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\dotnet\RCXAE34.tmp	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCXB072.tmp	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.cab	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Internet Explorer\ielowutil.cab	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCXB075.tmp	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.cab	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\dotnet\dotnet.cab	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.cab	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCXB13C.tmp	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Internet Explorer\iediagcmd.cab	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\RCXAD9E.tmp	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCXB073.tmp	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.cab	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCXB01E.tmp	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCXB13B.tmp	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.cab	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\RCXB1E0.tmp	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCXB02F.tmp	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCXB0D7.tmp	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.cab	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\7-Zip\7z.cab	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7z.cab	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\7-Zip\7z.exe	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCXB1D0.tmp	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.cab	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\RCXADB0.tmp	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCXB00C.tmp	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCXB01D.tmp	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCXB0B6.tmp	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-05_91457549300ebc927f112f0dbe01535e_elex_rhadamanthys_smoke-loader.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 324KB
SHA256 580df3d73d3aca48ae63fbce3a469495f2faf139bad1246597bee5c8339cde58
MD5 ed0188a95a3844154cfe1bbdd7d25623
SHA1 58819dfa8ccc0532b351988050c56ba3d4aa6d65
SHA512 40525da1b57f4f3ffcf918166af6f94087abf4cffed59d8bf662ad6ba8d5d2a5bc0c655b400ca8437b2976bd1d8c600996de09878747972b0ea03e969f6e06a9
SSDEEP 6144:XFlKgzelZNQSBQGH/CSpWqTyoAXjiU4bz:IfBQGH6SfeoAX+U4
TLSH
T12864F1457D93C4B3E0414D31C9E68AE14B7E6C037AA6E11BFF5D0B4B1EB13884BA66B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 1.5MB
SHA256 02794d05ba2672b8233c51c447ba486877289b1f11af8eb5e997ab32589ac272
MD5 9ddd40a0853e6a7e2d8717648bb5cc1a
SHA1 b8d51979cd35471e66a7d8c1892a25f78435dec9
SHA512 b4e167886c41aa06314525755d0b71d075365cc7a0a93e11f756509eac82b05ce099a11eddca47b80abb8133d69328839ec8135d80f4d20f79e36ca0fdadeead
SSDEEP 6144:HFlKgzelZNQSBQGH/CSpWqTXoAXjiU4bz:YfBQGH6SfLoAX+U4
TLSH
T1D46502457DA3D4B3D0414D3188E68BE18B7F6C137AA6E117FB9D0B4B1EB13844B6A361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXB16D.tmp

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCXB16D.tmp
Size 284KB
SHA256 05beb39f1c7aa2db6e5ba92e56bc482f5dadfe63e39ce96832add003633dcd6e
MD5 6a8c28efe4c69ba0d6ac1e095178bbff
SHA1 9a55552711a1f2621a391b555498889a36692a1f
SHA512 b1ba70f53cb4ad34f4fc4a844ea91ca8890ca36216e614d076fa7ecf1d349fb40b2f327be9dba2669be55b028175a94e06f87697ae2ab67e19a2042d8c5322a6
SSDEEP 6144:nFlKgzelZNQSBQGH/CSpWqTfoAXjiU4bz:4fBQGH6SfzoAX+U4
TLSH
T1AF5402457D93D4B3D0414D3188E78BE18B7F6C137AA6E11BFB9D0B4B1EB13884BA6261
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXB16E.tmp

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCXB16E.tmp
Size 284KB
SHA256 78bec9a1acbfe4104f879a87f6be6239e78edede03bc5da62fde446c8018551b
MD5 456f4aa257632f8b502d3414f905d3e9
SHA1 d01565fed194c887491b599830412165f85a7243
SHA512 013849d67a738181c31d04e1b19d534a24be12b2bb90f337b67329676d7f20437e0e84a120895508ffd0b8e54ed72099a57c95dd637ea9bf841ef9ea4ce6edb6
SSDEEP 6144:HFlKgzelZNQSBQGH/CSpWqTZoAXjiU4bz:YfBQGH6Sf9oAX+U4
TLSH
T1C45402457DA3C4B3D0414D3188E68BE19B7F6C137AA6E11BFB9D0B4B1EB13844B6A361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXB01E.tmp

Path C:\Program Files\Google\Chrome\Application\RCXB01E.tmp
Size 284KB
SHA256 4f9e02094131f6e486015b4900050c845967148e4602e79fdb9d4610eaf49c34
MD5 6cfde14f36b641aeb3dbf86538bde50f
SHA1 82729cc9bb86874fdb6fbfe610863dc3df148dbb
SHA512 82dee0bf1def8f94c716dcebec772c42efb60eaaa68721649d237651323200126d64d1a851244bf6aad96834fd4d6cb008761886f410548412eb3a27739f4a54
SSDEEP 6144:zFlKgzelZNQSBQGH/CSpWqTAoAXjiU4bz:cfBQGH6Sf0oAX+U4
TLSH
T1D154F1457D93C4B3D0414D31C9E68BE14B7E6C037AA6E11BFB5D0B4B1EB13884BAA6B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads