Analysis
- max time kernel
148s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/10/2026, 07:05
Behavioral task
behavioral1
Sample
2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe
- Size 288KB
- Sample261007-hwlt7svs5q
- SHA256 d27eb169a4800b914433ac66e637668722e15e15bb04a4ef9638fa029b6b0a58
- MD5 09dfa0839dbae53c2d7c7564fbf02362
- SHA1 9b7021037a1df231d514886722346d3a60b6d1f4
- SHA512 0054b93c307bb4e0aba3a37f26dd0e2cf43550e64f6d175eaf4f165cc8c9941ede4fd37281db799c9b1f4482ed56ca606b99b33fb6f973df7ace1ee3a0668948
- SSDEEP 6144:mFlKgzelZNQSBQGH/CSpWqTCoAXjiU4bzF:BfBQGH6Sf2oAX+U41
- TLSH T1765401917DA2D8B3C0419A3188A6CBA197376D139A65D203FBAD0F4B2F713D49B7B301
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000e00000001c490-3.dat family_cosmu behavioral2/files/0x000400000001bb27-86.dat family_cosmu behavioral2/files/0x000300000001bb29-184.dat family_cosmu behavioral2/files/0x000e00000001c4a7-188.dat family_cosmu - Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\J: 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\L: 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\G: 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\I: 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\K: 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\M: 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\N: 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\O: 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\D: 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\7zFM.cab 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX5EF5.tmp 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.cab 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.cab 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX5EF6.tmp 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX5F0A.tmp 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX5EE3.tmp 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX5F91.tmp 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX6077.tmp 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX5FF5.tmp 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\RCX6088.tmp 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX609A.tmp 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\dotnet.exe 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCX5DF0.tmp 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX5ECF.tmp 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX5F09.tmp 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCX60DC.tmp 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX5DAB.tmp 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX5DAC.tmp 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome.cab 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.cab 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX6099.tmp 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCX60DD.tmp 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7zFM.cab 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX5FB3.tmp 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\dotnet.cab 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX5F2B.tmp 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX5D78.tmp 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX5DDE.tmp 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCX5E11.tmp 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.cab 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.cab 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX6078.tmp 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7z.exe 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCX5DEF.tmp 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.cab 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX5F2D.tmp 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.cab 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX5F92.tmp 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX6045.tmp 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.cab 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-05_09dfa0839dbae53c2d7c7564fbf02362_elex_rhadamanthys_smoke-loader.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3384
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 332KB
- SHA256 aebaa2d4c87757d48b8a90363913a922bd4f06c3a39c37525c60d96b7f791804
- MD5 028c1f5f29cb3121d742384f28b6f9e9
- SHA1 2971b6e29a3e1908edd696c7300f192f0dd5ce7d
- SHA512 da03c6dfb6212abed66067a0027a5f8016a3387eb77b22e7c276b8db264936e5a3d857749aaf13b98254c03ad103594bf03d9f4d2ee67042f18fc2ba89b0e5c4
- SSDEEP 6144:zFlKgzelZNQSBQGH/CSpWqTvoAXjiU4bz:cfBQGH6SfboAX+U4
- TLSH T1957401817DA3D8B3D041493188A6CBA1973B6D13AA65D203FB9D0F4B2FB13D49B7A351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX5FB3.tmp
- Size 288KB
- SHA256 0c6719e19dc07f6e1170a88bde7deb43bee5d688eaee4f41c400b383a0138b3e
- MD5 777b8459d1597f3c870dc15c69821a8b
- SHA1 d5b5d190021795209ffee87fee7d815f4979dc57
- SHA512 9ea29ed30c8845a704a13c4711ee2cefd0b24e8ba14b36d61a30ac15d885f98378516de910896055261802f7485fd00f157dc74a1584f3b9caa89686c4212389
- SSDEEP 6144:jFlKgzelZNQSBQGH/CSpWqTjoAXjiU4bz:sfBQGH6Sf3oAX+U4
- TLSH T1DC5401817DA2D8B3C4414A3288A78FA197376D139A65D203F7AD1F4B2F713D49B7A205
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX5FB4.tmp
- Size 288KB
- SHA256 4a9bca2890f1d7227546a503fe3c513f39cc2753fc87a64999635c60595f01dc
- MD5 1c70284d94c724c260238b3a1682f773
- SHA1 63858bc88679b271ff47451b881ce2fb7c4af012
- SHA512 c9f5daac6b94d9ae4a9b56c2f0843ad1eabf05ad691c0542b9f68337367d2cf44c3c001e1cdafc9e16d7ddcacaf0039c56080e4b8879561bda0af6e99d153b21
- SSDEEP 6144:jFlKgzelZNQSBQGH/CSpWqTSoAXjiU4bz:sfBQGH6Sf+oAX+U4
- TLSH T1E55401917EA2D8B3C0419A315CA68BA197377D139A65D203B7AD1F4B2F713D09B7A302
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\RCX5ED2.tmp
- Size 288KB
- SHA256 bc404a4d039624444cb4c98a746a09816774670d1a95feab0f095b3bcaea282f
- MD5 62cafdbe1bc2c0d5f261f1f1ac7a6b1a
- SHA1 0f1e6c36716bfbbb3f396c81dae48c8d4e1ed715
- SHA512 2707d1d8e001439bd81d540c4c0acced06af76bfd34ab9602667635956a84013d99621ecc8f22a2034afa2fdc696bbbace793616599d8bce0782bf7a99ea49da
- SSDEEP 6144:/FlKgzelZNQSBQGH/CSpWqTYoAXjiU4bz:wfBQGH6Sf8oAX+U4
- TLSH T1D35401917DA2D8B3D041493188A68FA1973B6D13AA65D203FB9D0F4B2FB13D49B7B241
- MD5 SHA1 SHA512 SSDEEP TLSH