Analysis
- max time kernel
148s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/10/2026, 08:15
Behavioral task
behavioral1
Sample
2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe
- Size 344KB
- Sample261012-j5rbqact3m
- SHA256 e12faacf3755bca32bbe27a514b7b7ec29a66db14eed36be3472148e3a39558e
- MD5 1d9a2073b19524d853053807f964750d
- SHA1 cd01bbcd3122546b6f4946e7cf3cf51c02fb7e58
- SHA512 67fb4740153333e8742d5476f228bfbb9aeec0d0fe0ed461822b5a1e530164c73e8ad33388472ebf8a21f0365be85b4292b09fdfafc257f70c29e6f992dd5cd1
- SSDEEP 6144:0FlKgzelZNQSBQGH/CSpWqT9w7oAXjiU4bz:zfBQGH6Sf27oAX+U4
- TLSH T1C874E0503A9ECBB2D3C249318C6EFAA157767C2F9B65D133F7983B0F1E712845A66201
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000e00000001c558-3.dat family_cosmu behavioral2/files/0x000d00000001c56e-86.dat family_cosmu behavioral2/files/0x000800000001bb15-184.dat family_cosmu behavioral2/files/0x000300000001bb29-188.dat family_cosmu - Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\N: 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\O: 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\D: 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\G: 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\H: 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\I: 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\J: 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\K: 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\L: 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\RCX6008.tmp 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX6277.tmp 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX6287.tmp 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.cab 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX638F.tmp 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX6390.tmp 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX63A1.tmp 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX605C.tmp 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.cab 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.cab 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX63A2.tmp 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX63F6.tmp 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\readme.1xt 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX63C3.tmp 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX6227.tmp 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX62DA.tmp 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX62FC.tmp 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ExtExport.exe 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX605D.tmp 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCX60C2.tmp 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX616F.tmp 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7zFM.cab 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX6195.tmp 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.cab 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX6193.tmp 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX61A7.tmp 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX62DB.tmp 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\crashreporter.cab 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCX609F.tmp 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX632E.tmp 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCX60A1.tmp 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX6029.tmp 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX6181.tmp 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.cab 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX603C.tmp 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCX60A0.tmp 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX6194.tmp 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX631D.tmp 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.cab 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.cab 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX61A6.tmp 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.cab 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-12_1d9a2073b19524d853053807f964750d_elex_rhadamanthys_smoke-loader.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5948
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 325KB
- SHA256 0d22c63557d9f717a477987633526e75dee56c7fdf4f504718fada63a128af1f
- MD5 09fe51508f92d10dc9c53b8492117caa
- SHA1 c9085469165ec8b7f107bf104990b0da3ed25b01
- SHA512 0e002b2463d4e1a880d98a59e67f1c94553909b23ab3b2f8c6cb8d19422dbf1f8c5e6c8169a7f7280953b27f2df31c9d204821ea25460b619a9a1b45b81c5b7a
- SSDEEP 6144:tFlKgzelZNQSBQGH/CSpWqTyoAXjiU4bz:qfBQGH6SfeoAX+U4
- TLSH T15A64F1457D93C4B3E0414D31C9E68AE14B7E6C037AA6E11BFF5D0B4B1EB13884BA66B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX632E.tmp
- Size 284KB
- SHA256 0316c4459ed7458d07f022848ac8a57f708c5da651f5166796fb0552d85cd168
- MD5 a328c2f72bb04b1b2ea0a91777b35bf9
- SHA1 30474f4e18ac0ddc64f4cc1c49dc22e767ebe364
- SHA512 465b0bf09808ae22063d8a3d38e8158339454e53572399af6780ef2c53665cb2a72dfe200472e810524f420b16109b71bf25a0470a2417b1a4862c49292a4a3f
- SSDEEP 6144:FFlKgzelZNQSBQGH/CSpWqTfoAXjiU4bz:CfBQGH6SfzoAX+U4
- TLSH T1BD5402457D93D4B3D0414D3188E78BE18B7F6C137AA6E11BFB9D0B4B1EB13884BA6261
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX632F.tmp
- Size 284KB
- SHA256 aeeb345a44e450a1ffc33088706160ca8afecf0b4e8d33c66d5ac034e548e85b
- MD5 95842f3fec4796b380080ed49490e43c
- SHA1 5e228a1e8531a9d1f179c5b89b4847555e8aa8af
- SHA512 95d1105c266719bf00d8e10b76e8400d7864ba7ea2ad20f0cdfc94be276f6d6756b510002cdff42bd0dd12c5428ae9aa060294461f48e2ac6c7afae6ec5b2650
- SSDEEP 6144:1FlKgzelZNQSBQGH/CSpWqTZoAXjiU4bz:SfBQGH6Sf9oAX+U4
- TLSH T1FB5402457DA3C4B3D0414D3188E68BE19B7F6C137AA6E11BFB9D0B4B1EB13844B6A361
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\RCX6181.tmp
- Size 284KB
- SHA256 6bb3b6e5e912b956a355beac59461b227feace5b59d9807fd1ce761e78fac496
- MD5 d270c152ef0726332608687b16b420c5
- SHA1 ac5c73024912f007b423d56be247b02e7993ef46
- SHA512 f2651571288e84a11bb770805a432d6207b72424ff682b090247c4db4e5c374c04e8e78c9e3bc2a07fb65b1ab7595e974b7189653b604ab7530286d4a4f61013
- SSDEEP 6144:5FlKgzelZNQSBQGH/CSpWqTAoAXjiU4bz:OfBQGH6Sf0oAX+U4
- TLSH T1CE54F1457D93C4B3D0414D31C9E68BE14B7E6C037AA6E11BFB5D0B4B1EB13884BAA6B1
- MD5 SHA1 SHA512 SSDEEP TLSH