cosmu | 59e5a0e7b2e439b6c0ba79b8ac57e32163173946452e136256fa4f8b1401f1ae

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/10/2026, 00:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
Size 343KB
Sample261016-a4djsse17w
SHA256 59e5a0e7b2e439b6c0ba79b8ac57e32163173946452e136256fa4f8b1401f1ae
MD5 e8d5b303924052a0e268f8fd570699e9
SHA1 04ecc88ecdb3101c098645538c817e9515217598
SHA512 57c39abb67e39db7d816e91b5cecc6a94c87910cc799ecd79dc2f55a26edbaa04e6db07d90234b217a22a3ee57bfe20b253ac897bc272249d6eb2fa3c51c4e93
SSDEEP 6144:ZFlKgzelZNQSBQGH/CSpWqTNw/oAXjiU4bz:ufBQGH6SfG/oAX+U4
TLSH
T17F74D0003A9ECBB2D3C249318CAEFAE1477A7C2FAB559137F7983B0F1E712845656251
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery cosmu ransomware spyware worm

Malware Config

Signatures

Family: Cosmu
Cosmu is a Windows worm written in C++.
worm cosmu

Detects Cosmu payload 4 IoCs

Cosmu is a worm written in C++.

resource	yara_rule
behavioral2/files/0x000d00000001c4d5-4.dat	family_cosmu
behavioral2/files/0x000400000001bb3f-87.dat	family_cosmu
behavioral2/files/0x000400000001bb42-189.dat	family_cosmu
behavioral2/files/0x000800000001bb2d-185.dat	family_cosmu

Enumerates connected drives 3 TTPs 10 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\G:	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\K:	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\H:	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\I:	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\J:	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\L:	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\M:	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\N:	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\O:	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Control Panel\Desktop\Wallpaper = "C:\\windows\\WallPapers.jpg"	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\RCX5327.tmp	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX53C4.tmp	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX53E6.tmp	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.cab	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\RCX548E.tmp	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\dotnet\RCX5258.tmp	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Internet Explorer\ieinstal.cab	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.cab	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.cab	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX5236.tmp	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Internet Explorer\iediagcmd.cab	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.cab	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\RCX54C4.tmp	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.cab	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\RCX54D5.tmp	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCX5279.tmp	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCX5339.tmp	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\RCX54D6.tmp	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.cab	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCX5370.tmp	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.cab	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.cab	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCX534D.tmp	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.cab	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Internet Explorer\iexplore.cab	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCX534B.tmp	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\7-Zip\7z.cab	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.cab	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\RCX5203.tmp	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Java\jre-1.8\bin\java-rmi.cab	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Internet Explorer\ExtExport.cab	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.cab	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX53F8.tmp	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Mozilla Firefox\crashreporter.cab	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\7-Zip\7z.exe	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\dotnet\dotnet.cab	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\dotnet\RCX5247.tmp	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.cab	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.cab	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCX534E.tmp	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\extcheck.cab	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.cab	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\helper.cab	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\RCX51EF.tmp	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\RCX549F.tmp	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\windows\readme.1xt	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
File created	C:\windows\WallPapers.jpg	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Desktop\General\WallpaperSource = "C:\\windows\\WallPapers.jpg"	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Desktop\General	2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-15_e8d5b303924052a0e268f8fd570699e9_elex_rhadamanthys_smoke-loader.exe"
1⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:4084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 339KB
SHA256 181e80a1febbf76642205b5e9bcc54b7e6b2302976e4a53ece043f16776222bb
MD5 8cee907f33a222d0f26a01e3f8509c5e
SHA1 b2fa53803df7c1d923181a3cfc9477229c374aaa
SHA512 15bf2b8508be0e43d3178d9aa21b7bfc20857533d99cac00b77825de014faa1a800f898d5f649bf43d1c0b957472441e3cd08abb23e29a39bea05340157568f3
SSDEEP 6144:rFlKgzelZNQSBQGH/CSpWqTvoAXjiU4bz:UfBQGH6SfboAX+U4
TLSH
T1817401817DA3D8B3D041493188A6CBA1973B6D13AA65D203FB9D0F4B2FB13D49B7A351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX541A.tmp

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX541A.tmp
Size 288KB
SHA256 d83de3eab2024da6b03745486ba23fa295098b0655fb25ad2f5d14d831c1b2f8
MD5 aafa7fdbc6df68d3e7d8924b40a7f0d9
SHA1 0baa86268c72d3453429e1ee8100802418122c25
SHA512 b28444efbf5771c15379c75fd7b0101a0029b3da375e2f022ac72823de7135232532ec1ff130c6315006c29feedd8987d81e4081ba5d60ad65e7081ec2de2e4e
SSDEEP 6144:7FlKgzelZNQSBQGH/CSpWqTjoAXjiU4bz:EfBQGH6Sf3oAX+U4
TLSH
T12E5401817DA2D8B3C4414A328CA78FA197376D13AA65D203F7AD1F4B2F713D49B7A205
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX542B.tmp

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX542B.tmp
Size 288KB
SHA256 880d8a888c7bdb721b5e22220061596cfc6bc0a1350e89264f4f083665bbbce8
MD5 4049993e61679d2a10160052885a4b00
SHA1 7cd1813bcf6aab2f9ddccfc6e5d00c30bd3b38c4
SHA512 aa2f738efd1dbdd6344593b2d24ee089fe457bfb19a968dbbc25e70ba096c086a26b3eb1620c5727355ea0c38cd91209431406034b4fd9066b5eef25813e49e8
SSDEEP 6144:7FlKgzelZNQSBQGH/CSpWqTSoAXjiU4bz:EfBQGH6Sf+oAX+U4
TLSH
T1435401917EA2D8B3C0419A315CA68BA197377D139A65D203B7AD1F4B2F713D09B7A302
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX5339.tmp

Path C:\Program Files\Google\Chrome\Application\RCX5339.tmp
Size 288KB
SHA256 2f3e97cf6abb01cfda93939dd205a740b376488a286608cb52a002777a9839bf
MD5 20357ff68ae907cb51a1627d8d171762
SHA1 aeda49a958429ee4db671de18c45e62b676e320b
SHA512 b355942b80f3098259b30f65916279cdc57f6026a32d293ffcb1a49528e7ebce4c8f345c5ccf07a23013822f04715cfa5f29d0e5fe0297c164dcc37720dbe657
SSDEEP 6144:3FlKgzelZNQSBQGH/CSpWqTYoAXjiU4bz:ofBQGH6Sf8oAX+U4
TLSH
T1335401917DA2D8B3D041493188A68FA1973B6D13AA65D203FB9D0F4B2FB13D49B7B241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads