Analysis
- max time kernel
148s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/10/2026, 04:03
Behavioral task
behavioral1
Sample
2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe
- Size 284KB
- Sample261012-emdkpae13z
- SHA256 58056c3d12cd7693831432214e6899b535f796980a3fb0c20b796d65f933ada8
- MD5 de73af8a810e786b9c5ea43e3f4c7c9f
- SHA1 ed416d8f0bc1dd58ca1ad1f4902caa5af8ae83fb
- SHA512 509cd4659ec026d4337608476afe4330999143b95065a87b4bfd298334a37624d0d2ab2ad85f0602c2107e9d05dea32752bfdcb5432d883807db0d2f09590321
- SSDEEP 6144:xFlKgzelZNQSBQGH/CSpWqTLoAXjiU4bzF:mfBQGH6SfvoAX+U41
- TLSH T1395402457D93C4B3D0414D3188E68BE14B7F6C137AA6E11BFB9D0B4B1EB13884BA6761
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000500000001b86a-3.dat family_cosmu behavioral2/files/0x000400000001bb36-86.dat family_cosmu behavioral2/files/0x000d00000001c551-189.dat family_cosmu behavioral2/files/0x000800000001bb24-185.dat family_cosmu - Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\N: 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\H: 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\J: 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\K: 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\L: 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\M: 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\O: 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\D: 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\G: 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\RCX2011.tmp 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX2012.tmp 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.cab 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCX20BA.tmp 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX2225.tmp 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.cab 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7z.exe 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\dotnet.cab 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.cab 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX232D.tmp 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX2371.tmp 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX2078.tmp 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCX2099.tmp 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome.cab 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX2269.tmp 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.cab 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX2299.tmp 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX229B.tmp 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\RCX2360.tmp 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.cab 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\readme.1xt 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7zFM.cab 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.cab 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.cab 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.cab 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7z.cab 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX21BD.tmp 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.cab 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCX20AA.tmp 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX2169.tmp 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iexplore.exe 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX231C.tmp 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.cab 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX2065.tmp 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX21D0.tmp 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.cab 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX229A.tmp 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX2236.tmp 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX21BF.tmp 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.cab 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX2076.tmp 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX230A.tmp 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX21D1.tmp 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-11_de73af8a810e786b9c5ea43e3f4c7c9f_elex_rhadamanthys_smoke-loader.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3900
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 284KB
- SHA256 f78bf6797992a5dddadb8616560c0f62dad053ea58cf728875fe3cf6dda71475
- MD5 9c875f40452cc56520a27bd7ccbb02a7
- SHA1 c7334bc991de8019dc22654be4b430bb5e9ea88a
- SHA512 5bb6cb01cc9b7660015f6d6806a6937101ce6a41de8243de19a473a3a03d8549374e1211090843512a30b4a813c9b71ccb5d16f9fa25e70899a2aa2b33d3db59
- SSDEEP 6144:qFlKgzelZNQSBQGH/CSpWqTyoAXjiU4bz:tfBQGH6SfeoAX+U4
- TLSH T11754F1457D93C4B3E0414D31C9E68AE14B7E6C037AA6E11BFF5D0B4B1EB13884BA66B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX229A.tmp
- Size 284KB
- SHA256 c984937028dc10172e101c9444dbf055e8a68fe1ec19f15efed4c4f1c91bb36e
- MD5 30040b25d93df142a9c2550e2cd8edf4
- SHA1 73163c03ac1b7c0afce1bf81aeca3fe99fb523a7
- SHA512 f036a02fe42684a745c5a0e35582167173a0aeab64ad0c009ab67a5e2e02641a28a9c3ddc2d872e99e2e22a00720f559b4d51c841560416e09b5446eab3b26ff
- SSDEEP 6144:qFlKgzelZNQSBQGH/CSpWqTfoAXjiU4bz:tfBQGH6SfzoAX+U4
- TLSH T1AE5402457D93D4B3D0414D3188E78BE18B7F6C137AA6E11BFB9D0B4B1EB13884BA6261
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX229B.tmp
- Size 284KB
- SHA256 98f553f8254edf2c7d313f45488b076ac29b16678b98520918e94b455866f3bf
- MD5 b58cf2deaf724c7cae61af55652ae4f7
- SHA1 7628da3920288b9b1bf10223233b1e064d6a93f9
- SHA512 4a0865f07c828a4ae559596b612ac153458310bc9e00a116a252e2857eb64b00594e71d310da4759d6748c37990f8386690ef5ab8d9d2ce4fa62b69bd32ec505
- SSDEEP 6144:CFlKgzelZNQSBQGH/CSpWqTZoAXjiU4bz:FfBQGH6Sf9oAX+U4
- TLSH T1B35402457DA3C4B3D0414D3188E68BE19B7F6C137AA6E11BFB9D0B4B1EB13844B6A361
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome.exe
- Size 284KB
- SHA256 f283521a9dcffbc9cb2189258a6df0b2b984cd939e1724705fac06bc4720033d
- MD5 81212fc3c495d25e136c1df120f1a867
- SHA1 4e3f80cc2092ed5a46fe4c2e2f980ecef797823c
- SHA512 19ca2d8e8518d754d36ca736d349d427e0ed20cd6ac1884efd0d97cd7796333df2eba12e4884e56fdd10576c316a40fd09d6b36ff867b4efbca0a048f7e5caca
- SSDEEP 6144:GFlKgzelZNQSBQGH/CSpWqTAoAXjiU4bz:hfBQGH6Sf0oAX+U4
- TLSH T1AD54F1457D93C4B3D0414D31C9E68BE14B7E6C037AA6E11BFB5D0B4B1EB13884BAA6B1
- MD5 SHA1 SHA512 SSDEEP TLSH