Analysis
- max time kernel
148s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/10/2026, 10:18
Behavioral task
behavioral1
Sample
2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe
- Size 288KB
- Sample261015-mcbmcastdz
- SHA256 ad8216d4ab014b1d1ec38fc83109aa5b15ff0029e965acf7c100164fce4f0002
- MD5 7b9214bc1a0d9b5e151bd9d5afea68aa
- SHA1 5f3ab931bd9102472a8ca2db189d1c71bc12acf5
- SHA512 a50a535dbaa131114c26593eea3305a72050335b9bd5487f93bf7fe759c80f2c9900733a3d2aecba6f6f67263e4fbfa37b1bfba0434e57261247390b906906dd
- SSDEEP 6144:YFlKgzelZNQSBQGH/CSpWqT8oAXjiU4bzN:vfBQGH6SfYoAX+U49
- TLSH T1C65401917DA2D8B3C0419A3148A6CFA197376D139A65D203FBAD1F4B2F713D49B7A302
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000e00000001c465-3.dat family_cosmu behavioral2/files/0x000400000001baf5-86.dat family_cosmu behavioral2/files/0x000700000001bae6-184.dat family_cosmu behavioral2/files/0x000e00000001c47b-188.dat family_cosmu - Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\H: 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\I: 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\J: 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\K: 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\L: 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\M: 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\N: 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\D: 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\O: 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\RCX4FF7.tmp 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX514A.tmp 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCX515D.tmp 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7z.exe 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\dotnet.cab 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ExtExport.cab 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ExtExport.exe 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iexplore.cab 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX5138.tmp 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX4FAC.tmp 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ielowutil.cab 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX5137.tmp 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX4EC8.tmp 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX4FBD.tmp 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.cab 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX50A4.tmp 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX50B5.tmp 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.cab 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX4EC9.tmp 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.cab 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCX4F0C.tmp 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX4FD2.tmp 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX4FE4.tmp 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCX4F0D.tmp 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iexplore.exe 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX5116.tmp 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.cab 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.cab 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX4EA5.tmp 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX4FBE.tmp 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX4FE3.tmp 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX501C.tmp 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX5050.tmp 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7z.cab 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCX4F0B.tmp 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX5009.tmp 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.cab 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\RCX5127.tmp 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX4EB6.tmp 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.cab 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.cab 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.cab 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCX4F2D.tmp 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.cab 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-13_7b9214bc1a0d9b5e151bd9d5afea68aa_elex_rhadamanthys_smoke-loader.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5068
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 333KB
- SHA256 97927c44cd7dbb89ac87214189005261c32c4e857ec197a7ffdcbfb371f68a66
- MD5 3f5cac294c1e04e1512bd3c0ad1f5169
- SHA1 f8ca010ed7ac2aa385bc4dec5b297ed7098be5e6
- SHA512 51b6e54a592f4ba7d19a40eba3e453433319d13b3dca632ad7062c36432ddc17b77337efddd2b8d4e564b431bcee6d1c8f9af4c4d0742fd23ba8e486bb6fc9dc
- SSDEEP 6144:9FlKgzelZNQSBQGH/CSpWqTvoAXjiU4bz:afBQGH6SfboAX+U4
- TLSH T1DD7401817DA3D8B3D041493188A6CBA1973B6D13AA65D203FB9D0F4B2FB13D49B7A351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX5071.tmp
- Size 288KB
- SHA256 7c858059d4568d570cda4fab8a6eea2caaf5d5f6e5577059729739f8f9a77b2d
- MD5 3bbfa99d2b7ad9d0ce5fd91e770ba219
- SHA1 595c4e713937824db973a857464a1e50c2955737
- SHA512 653fb5ec1a1f861f62710b901e43aa37bfe2350acf48974855aa0060301445fe6957036a5bf3ac1143ce1296938f535e0804ad124e33d218a1fbf3c7230a5cc2
- SSDEEP 6144:9FlKgzelZNQSBQGH/CSpWqTjoAXjiU4bz:afBQGH6Sf3oAX+U4
- TLSH T1C75401817DA2D8B3C4414A328CA78FA197376D139A65D203F7AD1F4B2F713D49B7A205
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX5072.tmp
- Size 288KB
- SHA256 4c6789bc5d2f173369ee2d80b2fcafe0bc8b5346194618d13b7a46ec04a7321a
- MD5 2d7d66ec7ed5e85e6e805a25e5e3c083
- SHA1 fbaeabcf65057bd4b6d7dcdece07e1a15b743875
- SHA512 d61d480063a0db57bc4371d94dc83d0240665ceb7e0bca07afca0c701c1c3a4bc05a4b12a257b5d2aa2418fd9fc2e3d5842a6ef85f7cf01f31c34a829d996902
- SSDEEP 6144:lFlKgzelZNQSBQGH/CSpWqTSoAXjiU4bz:ifBQGH6Sf+oAX+U4
- TLSH T1D45401917EA2D8B3C0419A315CA68BA197377D139A65D203B7AD1F4B2F713D09B7A302
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\RCX4FBF.tmp
- Size 288KB
- SHA256 f5199c2394d730a819fab337b324b770e6104eb552fbd70155225d26093ec708
- MD5 84befb50ca6e3793b83373c50acbfb66
- SHA1 316c023b8ed54abb74f5a254b75db45ee32ac475
- SHA512 7bd87f67b9e30a1c060fc08beea2ae432ea49203f8dca656411408ebee253bd3f03fb2afac5da1231e399ea1d7db95a73133580b8804694c9c0a2438c2257717
- SSDEEP 6144:RFlKgzelZNQSBQGH/CSpWqTYoAXjiU4bz:GfBQGH6Sf8oAX+U4
- TLSH T1F05401917DA2D8B3D041493188A68FA1973B6D13AA65D203FB9D0F4B2FB13D49B7B241
- MD5 SHA1 SHA512 SSDEEP TLSH