Analysis
- max time kernel
150s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/10/2026, 08:31
Behavioral task
behavioral1
Sample
2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe
- Size 1.4MB
- Sample261017-keyhsacx2w
- SHA256 ae77a375026f41ad9eaa60e09609b0c8c4201a5c4bbd9820f51ba2ba4eaf5285
- MD5 b77bd60c98a876c81bd34de2cf8b3504
- SHA1 63ef7a6461c924ac6778a3a46d1d0b979b23efac
- SHA512 3a2a4b559454043a924b0d9134cf0868cd5a5a68c11d54c8b0304e9d07c0f683beb9b15b2f105bba84deed3e7be1b8cf2c12e17d223cdc9dacd9f29e47df4c35
- SSDEEP 24576:2fa86Sf7kQ5W9GIpThCTZ0og6f5MLb+VONw/haSqnFGUMhglHZaaw+Xax:2fayQL9fpTgTZ0og6fWLb+VOa/hunKhj
- TLSH T16865DFC2F602D0A5DC1645308C27DFF81B16BE22AD1116177BD8BF5FAEB3382592259B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000e00000001c51f-3.dat family_cosmu behavioral2/files/0x000d00000001c52b-86.dat family_cosmu behavioral2/files/0x000f00000001c52c-188.dat family_cosmu behavioral2/files/0x000300000001bb36-184.dat family_cosmu - Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\O: 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\G: 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\J: 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\D: 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\H: 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\I: 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\K: 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\L: 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\M: 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCX66D8.tmp 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX6406.tmp 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX6407.tmp 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7zFM.cab 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCX62E3.tmp 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX66C6.tmp 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX6290.tmp 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX62B1.tmp 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX63E0.tmp 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX667F.tmp 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX62B0.tmp 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\dotnet.cab 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX6450.tmp 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX665E.tmp 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX643D.tmp 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX625B.tmp 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.cab 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX644E.tmp 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX6680.tmp 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX626B.tmp 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX6480.tmp 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX6692.tmp 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\dotnet.cab 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ielowutil.exe 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX666F.tmp 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iexplore.exe 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX626C.tmp 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX63F3.tmp 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX6470.tmp 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ExtExport.cab 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iediagcmd.cab 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iexplore.cab 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\readme.1xt 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7z.exe 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX642A.tmp 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.cab 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX664D.tmp 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.cab 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ielowutil.cab 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.cab 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX664E.tmp 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.cab 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.cab 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCX66D7.tmp 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCX6303.tmp 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCX6314.tmp 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX6429.tmp 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.cab 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-16_b77bd60c98a876c81bd34de2cf8b3504_elex_rhadamanthys_smoke-loader.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4668
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 334KB
- SHA256 0726c4e5b4a52169d1bd7fdfdb744c4fad517f3ffbcbd2cb991294f8f94f65c9
- MD5 5091622e75722f791cb02282321207a2
- SHA1 e557b4bdf97f09af9eb36601ed6acd532fc91e97
- SHA512 b97145f1ab3042b759a49122d852af3fd249e36063d2076b6fc76e375db474fcbdb27e567a5753d5051514f15ffd6497df859fe99cb07841146ccc2c41b8434a
- SSDEEP 6144:KFlKgzelZNQSBQGH/CSpWqTvoAXjiU4bz:NfBQGH6SfboAX+U4
- TLSH T1F27401817DA3D8B3D041493188A6CBA1973B6D13AA65D203FB9D0F4B2FB13D49B7A351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX660C.tmp
- Size 288KB
- SHA256 0aed4dd820999d8439ce1b72f3aaf61bb21515143ed3ea4e06e2cc2c1d6bc03a
- MD5 d6afefa7ee0ea4c83527d37fcfd8e724
- SHA1 3330e18c4e44a536958b0f22c5751b9b69e9eb0a
- SHA512 3db3946981343ce15127e379cfdf5e1f8b81cc091aa9f6cf105330a90a4ffdd9272a832b0a95399f55d453e76e43f160d3fb6a1d254fa0a43f4b02c16f277544
- SSDEEP 6144:SFlKgzelZNQSBQGH/CSpWqTjoAXjiU4bz:1fBQGH6Sf3oAX+U4
- TLSH T1565401817DA2D8B3C4414A328CA78FA197376D139A65D203F7AD1F4B2F713D49B7A205
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX661D.tmp
- Size 288KB
- SHA256 6fa851eb2e841df1779ded12bf1b9052c1f8c06f5f2d5cace789944119e95545
- MD5 37da8f6814fcd2cc42a4a86ac1ca097f
- SHA1 550c23018303674e7106f6b3c6c221db6b45ce33
- SHA512 0a14169ef13c0782b4eef3538054d429ccfb539994729e304cd8846de462de61454e01dce67835b3a6ec5aa71e857d0a69a590a11eac85778e83284766d80088
- SSDEEP 6144:yFlKgzelZNQSBQGH/CSpWqTSoAXjiU4bz:VfBQGH6Sf+oAX+U4
- TLSH T1A15401917EA2D8B3C0419A315CA68FA197377D139A65D203B7AD1F4B2F713D09B7A302
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\RCX63F2.tmp
- Size 288KB
- SHA256 4bca71386cde93e9e56d96935360c9909f853c427d132119cec6c11c006b8314
- MD5 5835de4a8ae2b44467577df8c9196171
- SHA1 7f7e72a93a6a63ddf053426278fe3f147fb55e5a
- SHA512 e33093607ec60efa028b43352cdd75db64d4ab2c4419045d2f5f974c06b74d4bab0be69abd248a97cd55786835bad46a5fcc18920648c2176d68de15c58cdb7c
- SSDEEP 6144:eFlKgzelZNQSBQGH/CSpWqTYoAXjiU4bz:ZfBQGH6Sf8oAX+U4
- TLSH T1655401917DA2D8B3D041493188A68FA1973B6D13AA65D203FB9D0F4B2FB13D49B7B241
- MD5 SHA1 SHA512 SSDEEP TLSH