Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/10/2026, 19:42
Behavioral task
behavioral1
Sample
2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe
- Size 2.1MB
- Sample261015-yet29aws2r
- SHA256 f3ea24ce1b9a025c138794e3194097ee3b63fadbb144224db210b18fdf98b0e6
- MD5 0f173977be08424fdc7f05cbaa0e5070
- SHA1 70cef26d05c208449b7b7c5fffbbd5353ae2d30e
- SHA512 3aefed69b547690fa1324c8eb751cb11b5ba6206c3391f49b30627c51db61611b0daf5cd4194125df1f3a522c560d4bde50ed9dde5adce269760bca3607610d4
- SSDEEP 6144:lFlKgzelZNQSBQGH/CSpWqTbHHHHHHHCoAXjiU4bz:ifBQGH6SfHHHHHHHHCoAX+U4
- TLSH T1B3A5A5E42741A76DE5F30A3A0654857423F73E8B7C8E72B26D55370BAA30960B7CB21D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000d00000001c540-3.dat family_cosmu behavioral2/files/0x000d00000001c557-86.dat family_cosmu behavioral2/files/0x000d00000001c55a-176.dat family_cosmu behavioral2/files/0x000300000001bb46-185.dat family_cosmu - Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\L: 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\M: 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\N: 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\D: 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\J: 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\O: 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\G: 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\H: 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\I: 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\7z.exe 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXF379.tmp 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCXF58E.tmp 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCXF5B0.tmp 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXF3AC.tmp 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCXF403.tmp 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ielowutil.exe 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCXF55C.tmp 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCXF286.tmp 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.cab 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCXF4F5.tmp 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ielowutil.cab 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iexplore.cab 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ieinstal.cab 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCXF56D.tmp 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCXF201.tmp 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCXF4C4.tmp 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ExtExport.exe 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\RCXF54B.tmp 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCXF59E.tmp 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXF39B.tmp 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXF344.tmp 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCXF55D.tmp 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCXF413.tmp 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCXF426.tmp 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCXF244.tmp 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.cab 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.cab 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCXF424.tmp 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.cab 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.cab 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7z.cab 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXF357.tmp 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.cab 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCXF425.tmp 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCXF4B3.tmp 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.cab 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCXF254.tmp 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXF3AE.tmp 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.cab 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-13_0f173977be08424fdc7f05cbaa0e5070_elex_rhadamanthys_smoke-loader.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4468
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 328KB
- SHA256 85669aa2141d79347ed65194ecf17a366214dcaf61ca263d706adc8500a9a586
- MD5 283460086fa7e036ee9b7cfc63d47606
- SHA1 4308de657726d84f2a74d2d7b3f2a7d1ae7657ce
- SHA512 a9ba32e70906e58447009cadd8de2b7f77fd2fef15ca59d20bb40f31addce44f56f2a3467edda3c59d2535c7d0469b026025fbecea4f6b91800e860a0f8efc80
- SSDEEP 6144:sFlKgzelZNQSBQGH/CSpWqTvoAXjiU4bz:rfBQGH6SfboAX+U4
- TLSH T1656401817DA3D8B3D041493188A6CBA1973B6D13AA65D203FB9D0F4B2FB13D49B7A351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCXF4C4.tmp
- Size 288KB
- SHA256 0b6ba54239ee177d5c9ca2f8cdca824af2249b3de0a4b999a441daa64c4fd668
- MD5 269365ece9494e29cf07145e33a71363
- SHA1 9dde5469b1bf180700b563bc53bf36e1fb040539
- SHA512 efacddb88e94a2e331ad43e3edf7835630dfad1880c395497dba9a936b6147270708973330aa021afedfe75c5bd24090a2f3d6a473071c11611dc1f5fad47d06
- SSDEEP 6144:kFlKgzelZNQSBQGH/CSpWqTjoAXjiU4bz:DfBQGH6Sf3oAX+U4
- TLSH T11F5401817DA2D8B3C4414A3188A78FA197376D139A65D203F7AD1F4B2F713D49B7A205
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 1.5MB
- SHA256 ccd65ead2bb74f1dfd010b797fffd901cc000efdf89f493d213836126e71e672
- MD5 abd24519d08179aa7d1152fa0fc2d9ba
- SHA1 d8f37c9e871d01e2c7362aaa02eda2a0471614b7
- SHA512 365f3a4d2d0d83ec697d60fb22be903bfea657a7c40b968f98820bd53d24b45426c241c84cb86abb5b98e6325c96cd05bf75581da6bc14f368eda36eb386e77f
- SSDEEP 6144:MFlKgzelZNQSBQGH/CSpWqTSoAXjiU4bz:LfBQGH6Sf+oAX+U4
- TLSH T12F6501917EA2D8B3C0419A315CA68BA197377D139A65D203B7AD1F4B2F713D09B7B302
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\RCXF356.tmp
- Size 288KB
- SHA256 93b810058fb81c75ae51580fc519a44de04eaec231799a7b9f0588be85254117
- MD5 ab5cc2d5d439f61193715079119e9c03
- SHA1 3e49fbb15b81dd11a1df721fa9a695323a14c2db
- SHA512 82f3431aaafb62b2d37d2203784a6a2d2ee9c7e8405bed00bb7c7db73227f95e7e7d0e9a555aa9775e18e2327b0146bf080c4cbda90e9ff4c9e730264a790514
- SSDEEP 6144:IFlKgzelZNQSBQGH/CSpWqTYoAXjiU4bz:/fBQGH6Sf8oAX+U4
- TLSH T1D85401917DA2D8B3D041493188A68FA1973B6D13AA65D203FB9D0F4B2FB13D49B7B341
- MD5 SHA1 SHA512 SSDEEP TLSH