Analysis
- max time kernel
148s - max time network
140s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/10/2026, 07:29
Behavioral task
behavioral1
Sample
2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe
- Size 1.5MB
- Sample261007-jbeqtsft6r
- SHA256 619f1cc723cb60ea54a493413eb92fb65f9a798561fd2e240332a8a3b91b6788
- MD5 05ed7b3e40a182094b362697d742b0b5
- SHA1 97e2fe161f9a4c7bf7ba140e5ec740ec69ab9326
- SHA512 ff35b43183f5aa8bcabc55a02b637c782a6aaa31b8545a126e2bcb7e07a7f3e23bea94370f061a14c4d791bb543144649552bae507f096d2ceb2e122d40cdc70
- SSDEEP 6144:lFlKgzelZNQSBQGH/CSpWqTfueF/mNyBqoAXjiU4bz:ifBQGH6SfaCBqoAX+U4
- TLSH T11065CFB17B93856BD4E7C23CB1858593ABF69B031D539263D7A0EE3DCA392814DD8C42
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x001400000001c481-3.dat family_cosmu behavioral2/files/0x000d00000001c4c9-86.dat family_cosmu behavioral2/files/0x000500000001bae3-184.dat family_cosmu behavioral2/files/0x000400000001bae6-188.dat family_cosmu - Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\G: 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\I: 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\K: 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\M: 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\N: 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\O: 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\H: 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\J: 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\L: 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCX783E.tmp 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome.cab 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX7611.tmp 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX7792.tmp 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.cab 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.cab 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.cab 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX77E8.tmp 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX767A.tmp 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX7647.tmp 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX76BC.tmp 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX7724.tmp 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ExtExport.exe 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iediagcmd.cab 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX7633.tmp 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.cab 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX7809.tmp 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7z.exe 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX747A.tmp 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX77C5.tmp 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7z.cab 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX7612.tmp 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX7723.tmp 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.cab 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCX783D.tmp 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX7659.tmp 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iexplore.cab 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.cab 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.cab 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX76BD.tmp 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.cab 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\RCX77F8.tmp 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.cab 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX76F1.tmp 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX7623.tmp 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX7634.tmp 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX7712.tmp 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iexplore.exe 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX76DF.tmp 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX76F2.tmp 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.cab 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX748D.tmp 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX749E.tmp 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX7610.tmp 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX769C.tmp 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.cab 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCX7554.tmp 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-05_05ed7b3e40a182094b362697d742b0b5_elex_rhadamanthys_smoke-loader.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4328
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 336KB
- SHA256 72f66222cd6494ba72fcc18ef0258a54d8300cfc8455a1d567ab1b947ccbb215
- MD5 b10d4953ed165e15c4ae8db2c40a450f
- SHA1 51b766baf2c7ffd40cd8e8ed63cf7e2a4fb938ce
- SHA512 25e6ca2db7c02dac595ef4e8312c37223674e655a3628114f1bb38788069485976d94727fcd294ebdb78329ac3965efe40bb9f27669bb45ec55a50705f2ee9ad
- SSDEEP 6144:yFlKgzelZNQSBQGH/CSpWqTvoAXjiU4bz:VfBQGH6SfboAX+U4
- TLSH T1797401817DA3D8B3D041493188A6CBA1973B6D13AA65D203FB9D0F4B2FB13D49B7A351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX7723.tmp
- Size 288KB
- SHA256 519542ae2f76246239445f6c8bf86ecb598577720ce7df62abba5f37329f92e3
- MD5 e1f420eecc463eacb8ae340cd8b1baf0
- SHA1 d65837c3bf90ec23b4c6e639b3cc67f68f82d3ba
- SHA512 77793aa87ccff75d96fb167c688a0da4f56c75f9ecad80e283a2a2eb7f558c0f2f07ac92ce67191e1818b666a23c2cd03f20567565c1b7d852059fc96a0be4cc
- SSDEEP 6144:6FlKgzelZNQSBQGH/CSpWqTjoAXjiU4bz:dfBQGH6Sf3oAX+U4
- TLSH T1BE5401817DA2D8B3C4414A3288A78FA197376D139A65D203F7AD1F4B2F713D49B7A205
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX7724.tmp
- Size 288KB
- SHA256 48ddebe09ea5d19b49b2c7c312ebaa345c4503f2a34ebc8b5d23d4ed99ed7288
- MD5 131556a60c170f5c3bb85481b16d00aa
- SHA1 245627c35060cb9cdc313f5cb9a1b994041f1d89
- SHA512 1ab8c23d2be016e47c1296a4fd281f2c0133020046989091246a1ed42701f81784dac1815bc2841d05595b549f60ce23efd74b41f17a60fd1c4f5570e87eed25
- SSDEEP 6144:aFlKgzelZNQSBQGH/CSpWqTSoAXjiU4bz:9fBQGH6Sf+oAX+U4
- TLSH T16D5401917EA2D8B3C0419A314CA68BA197377D139A65D203B7AD1F4B2F713D09B7A302
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\RCX7623.tmp
- Size 288KB
- SHA256 d10094f11b1bb6ee5c202e2d905cc0b57de11e9b1743d24c1cf182eff11bfea5
- MD5 99d0d6e8d2abee3329a83285edc5d592
- SHA1 4a65d1ae305c5e21dea4a95fe7f961cc33433701
- SHA512 444e2c1f0081db3d1251148cdaf84b27aafaf177057d8d3e54dcd6a52561db5c1b232a1b53cf9303880b92ad00de925d48acc0c312ba886c5b65317c927ea8cb
- SSDEEP 6144:GFlKgzelZNQSBQGH/CSpWqTYoAXjiU4bz:hfBQGH6Sf8oAX+U4
- TLSH T19A5401917DA2D8B3D041493188A6CFA1973B6D13AA65D203FB9D0F4B2FB13D49B7B241
- MD5 SHA1 SHA512 SSDEEP TLSH