Analysis
- max time kernel
148s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/10/2026, 08:28
Behavioral task
behavioral1
Sample
2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe
- Size 296KB
- Sample261011-kdaeka1v8k
- SHA256 007849fda7a97523e042bfcf0ab69c355ca7d54776590b02a111310829b753c6
- MD5 8fc98c525670666306e635e40b47446c
- SHA1 35e022aa20bbe72bf2f5efe3ac5c18988e9b9444
- SHA512 0ceee19728e8300602ab1cd4f5ece7efd4372a6e9e3e6f9c9a1aad2b7d257c3e53c7925fba05dcb42cd18d9816e81001471207dfab2869496f0f231b4087dcf2
- SSDEEP 6144:gFlKgzelZNQSBQGH/CSpWqT+oAXjiU4bzt:XfBQGH6SfyoAX+U4d
- TLSH T1CA54F1813992D8B2D041553188ABCFA1873BBC139A65D243F7D92F4F2EB13D4AB6B315
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000e00000001c4c9-3.dat family_cosmu behavioral2/files/0x000d00000001c4dc-86.dat family_cosmu behavioral2/files/0x000300000001bb29-184.dat family_cosmu behavioral2/files/0x000f00000001c4df-188.dat family_cosmu - Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\H: 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\I: 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\J: 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\M: 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\N: 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\O: 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\G: 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\K: 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\L: 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\chrome.cab 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7zFM.exe 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX35CC.tmp 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX3610.tmp 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ieinstal.cab 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX32F3.tmp 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iexplore.cab 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX3673.tmp 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX3560.tmp 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX3561.tmp 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX3585.tmp 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX35FF.tmp 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX354E.tmp 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.cab 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\RCX36B9.tmp 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX3587.tmp 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\dotnet.cab 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX354F.tmp 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX3562.tmp 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX3631.tmp 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.cab 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ielowutil.cab 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCX3491.tmp 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX36A7.tmp 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX36A8.tmp 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCX370C.tmp 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX35CD.tmp 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.cab 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX3674.tmp 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX3323.tmp 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX3573.tmp 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX3586.tmp 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.cab 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7z.cab 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX3598.tmp 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\crashreporter.cab 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCX370D.tmp 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX32D1.tmp 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\dotnet.exe 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-10_8fc98c525670666306e635e40b47446c_elex_rhadamanthys_smoke-loader.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4704
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 330KB
- SHA256 9e151019d150dd080895ce004d6cb4ea69f70ad57e02ee6a8aba8c52f9e8d49f
- MD5 3247ac8d511667d2d8f8874ceed4db98
- SHA1 d408060e2d157c6c18e2bc023e32314a64db46f1
- SHA512 f1eebdbef8875aeb6d14f69740c7640ef1e0b678c93facf6f792507aaca79db9d885f88b233125528281f4fde8e6382a9be5442978930187e6297de2bf9b9187
- SSDEEP 6144:+FlKgzelZNQSBQGH/CSpWqTvoAXjiU4bz:5fBQGH6SfboAX+U4
- TLSH T1FA7401817DA3D8B3D041493188A6CBA1973B6D13AA65D203FB9D0F4B2FB13D49B7A351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX3632.tmp
- Size 288KB
- SHA256 ac86f49b36886a7092cdbf27777b23aecefa1d23f1d92dfaf5370dc2f2ad428d
- MD5 fae6a2b74fccab37126ab8b604b30051
- SHA1 2c27573061adc16086c31a489c769f7233459f3c
- SHA512 00b03e7cd2117afeddca6c550a4ba6f3cacedd102036c3dc39dcaebee18cec2b378ff0603ffbce049137f342db18df83f2537dc0b3b8ad68651608f3fa85ede3
- SSDEEP 6144:WFlKgzelZNQSBQGH/CSpWqTjoAXjiU4bz:RfBQGH6Sf3oAX+U4
- TLSH T1F75401817DA2D8B3C4414A3288A78FA197376D139A65D203F7AD1F4B2F713D49B7A205
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX3643.tmp
- Size 288KB
- SHA256 ee315746851d7a141d2c453bab40cc31c5caff3e7818a30e4cca0d4e3d33f81f
- MD5 f547f49753139027500c655100f590bd
- SHA1 9c0b1ac5b399e3efff3dc6209e121fda7ff07e2c
- SHA512 bc22d958e64e18f25c8c4e374e2b4e13989ade01fb9abbdfac70e57e4bf1e2c7af5dea5941f5b92db805a9980876c6047e4d640b73009ab145268180509f29cc
- SSDEEP 6144:mFlKgzelZNQSBQGH/CSpWqTSoAXjiU4bz:BfBQGH6Sf+oAX+U4
- TLSH T1B15401917EA2D8B3C0419A314CA68FA197377D139A65D203B7AD1F4B2F713D09B7A302
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\RCX3561.tmp
- Size 288KB
- SHA256 6fe89a32eacc3abf58a76c129b9a374157cc47f71225c3677b44eac17c3652db
- MD5 cf28100130c17abcd02ca1cc4bff7373
- SHA1 834d6afb60b81295fbbdf6e4b8c04a8d9b2e75b3
- SHA512 dc4350f59778f6d7b2305194be25c6c709f2e9a758ac818a38d229ed36c5eb9be0a71b938d1abd5ba54a0e5ba6f4bb0c4169a076cdae58dc90d564080ece527a
- SSDEEP 6144:SFlKgzelZNQSBQGH/CSpWqTYoAXjiU4bz:1fBQGH6Sf8oAX+U4
- TLSH T1095401917DA2D8B3D041493188A6CFA1973B6D13AA65D203FB9D0F4B2FB13D49B7B241
- MD5 SHA1 SHA512 SSDEEP TLSH