cosmu | 4a5f2234265917e534b63f8e0a424270669b95a54c5cd8b017966106c1fb8e1b

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/10/2026, 15:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe
Size 1.5MB
Sample261020-stbxbsft4k
SHA256 4a5f2234265917e534b63f8e0a424270669b95a54c5cd8b017966106c1fb8e1b
MD5 7d15261c966ae91bb02ddab170144e67
SHA1 28060193eee676628be326b0506df5a880b79c93
SHA512 d80a3d05be04ed249d4d6601d288c031a35c9f266f2c06b2c85ec331806214b1b71664cb93474002bacfc0b9bc35db551c1f6abd65f70447624d15ab0f7b3c5e
SSDEEP 6144:TFlKgzelZNQSBQGH/CSpWqTdoAXjiU4bz:8fBQGH6SfJoAX+U4
TLSH
T1386501817AA2D8B3C4429A314CA68F6197377D139A65D203B7AD1F4B2F713D09B7A302
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery cosmu worm

Malware Config

Signatures

Family: Cosmu
Cosmu is a Windows worm written in C++.
worm cosmu

Detects Cosmu payload 6 IoCs

Cosmu is a worm written in C++.

resource	yara_rule
behavioral2/files/0x000e00000001c50c-3.dat	family_cosmu
behavioral2/files/0x000400000001bb36-86.dat	family_cosmu
behavioral2/files/0x000f00000001c519-152.dat	family_cosmu
behavioral2/files/0x000f00000001c51b-189.dat	family_cosmu
behavioral2/files/0x000700000001bb27-185.dat	family_cosmu
behavioral2/files/0x000300000001b980-267.dat	family_cosmu

Enumerates connected drives 3 TTPs 10 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\I:	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\J:	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\L:	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\N:	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\O:	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\D:	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\G:	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\K:	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\M:	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCXF294.tmp	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\dotnet\RCXEFE3.tmp	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\extcheck.cab	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCXF1A0.tmp	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.cab	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCXF17D.tmp	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Internet Explorer\ExtExport.cab	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Internet Explorer\ielowutil.exe	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCXF0E6.tmp	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\7-Zip\7z.exe	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\RCXF31B.tmp	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\RCXF32C.tmp	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\RCXEF7C.tmp	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCXF016.tmp	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.cab	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCXF139.tmp	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCXF15C.tmp	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\RCXF30A.tmp	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\RCXF33E.tmp	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.cab	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCXF295.tmp	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\RCXF2F9.tmp	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\RCXF31C.tmp	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCXF0E5.tmp	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCXF17E.tmp	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.cab	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCXF240.tmp	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.cab	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCXF0D4.tmp	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Internet Explorer\iediagcmd.cab	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Internet Explorer\iexplore.cab	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Java\jre-1.8\bin\jabswitch.cab	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\RCXF2D7.tmp	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Mozilla Firefox\crashreporter.cab	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.cab	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\7-Zip\7z.cab	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\7-Zip\7zFM.cab	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCXF14A.tmp	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCXF16C.tmp	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCXF19F.tmp	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.cab	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCXF262.tmp	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\RCXEF8D.tmp	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\RCXEF90.tmp	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCXF1C1.tmp	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Internet Explorer\ielowutil.cab	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-19_7d15261c966ae91bb02ddab170144e67_elex_rhadamanthys_smoke-loader.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 329KB
SHA256 f679e7a98c90f2348f7fb470de092bc6ff164c8c36a49a13df1979375b13a3d3
MD5 70424d515f3b22781089f959429f8b37
SHA1 7ace0828a10a2b358dda4374f3662bbbf753d04b
SHA512 0749ea92acfb31c7fe0dae79f4f6701da2a5ea0fcb2d9b2e5fe4b7cf05d44cfe996fa67f990836c331b6ec8b089f3c829ab32890443cb8661e401bed5ab5563a
SSDEEP 6144:2FlKgzelZNQSBQGH/CSpWqTvoAXjiU4bz:xfBQGH6SfboAX+U4
TLSH
T16E7401817DA3D8B3D041493188A6CBA1973B6D13AA65D203FB9D0F4B2FB13D49B7A351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXF272.tmp

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCXF272.tmp
Size 288KB
SHA256 c696279aa0001b9faf5c1f24e052113475f9a99d2534e91d95a7bff145c9b684
MD5 eadf57a3b5fa800fb8bf27a599d04837
SHA1 e1980ee5c424e91c28622e63532b9568f8146bf6
SHA512 d131eea5e3c1b25c17cc3055b3850f8aa1d0f51dcb63ca046f407fb8c56624da3c91e4750328569ba5c645680d33702813ee63196546d5ad5633e06371dbfbe0
SSDEEP 6144:OFlKgzelZNQSBQGH/CSpWqTjoAXjiU4bz:pfBQGH6Sf3oAX+U4
TLSH
T1905401817DA2D8B3C4414A328CA78FA197376D139A65D203FBAD1F4B2F713D49B7A205
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXF273.tmp

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCXF273.tmp
Size 288KB
SHA256 aaafd25abcb9486a03cf0b7aa4b9079ecae1d0170177d0ee0eaa4a569fdb1f7d
MD5 b0ae2f01c9cb64254af58ab4a022e2b6
SHA1 673ea72e5dd1166247afef582b83f099826895fa
SHA512 e95c8832f3a0649c557ab1023b0946fa6cf5b5f7d7db85511c4f56c009c132943b984d22215a23505b7aa1f28971f75b5574ad8db30dd931edf0af24ea308c45
SSDEEP 6144:+FlKgzelZNQSBQGH/CSpWqTSoAXjiU4bz:5fBQGH6Sf+oAX+U4
TLSH
T1775401917EA2D8B3C0419A315CA68BA197377D139A65D203B7AD1F4B2F713D09B7A302
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 1.5MB
SHA256 1f0327ffee665404e03a819630bf7b1df22527f87f4ec2ad37fa102535d8e683
MD5 2da1c602230f9887c4cc3740dd5eb51a
SHA1 86aca91c2014a278084c8f5e440b49d006fbc274
SHA512 cecf1993ff736b4e71ac7598739ba4a3dee5288cca5dd05e68c28c86cf1de65b59e69412d221a487a84ed6cf25c3f50861a2ff9da8da8d2a3c9c4231d9a6fcc1
SSDEEP 6144:OFlKgzelZNQSBQGH/CSpWqTZoAXjiU4bz:pfBQGH6SftoAX+U4
TLSH
T12A6501917EA2D8B3C4429A3148A68F6197377D139A65D203B7AD1F4B2F713D09B7B302
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXF0E5.tmp

Path C:\Program Files\Google\Chrome\Application\RCXF0E5.tmp
Size 288KB
SHA256 296ec5568101be9788025639c2f1c091066ba052479a167409646238cb9dfd8c
MD5 7753373c6bb609f01f6ce9f027dcddb4
SHA1 249295055e536eebc4d139451e2387699a3c1084
SHA512 157bb5898da1f9f3e14d4d6beefe13bbd44ee76ab96b0df32f7d6bd55086c72f68f8055419207b3a398b5d172eb081564f3848009d811020f9623dd087079fa4
SSDEEP 6144:qFlKgzelZNQSBQGH/CSpWqTYoAXjiU4bz:tfBQGH6Sf8oAX+U4
TLSH
T1395401917DA2D8B3D041493188A68FA1973B6D13AA65D203FB9D0F4B2FB13D49B7B241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

helper.exe

Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe
Size 353KB
SHA256 819098652d49a803f62eb743f92df9a5a7b2de1645009b9ad99eaea72eab64ac
MD5 6e57799d64a680a6ecfde67e7a6a64e1
SHA1 015e53150815e223b360640600eb4f5a650801d0
SHA512 a4eb5ae6eacf6f958b0e371229886d819b06034cb482e556b4247b24f600c1d60af1d3d5c3693f3a1b60b9ce87c0c438e6cd1a336fc54f1b054e0e3a67f2d981
SSDEEP 6144:vFlKgzelZNQSBQGH/CSpWqTnUjD5yoAXjiU4bz:AfBQGH6SfzUjD5yoAX+U4
TLSH
T1D774F1427EA2D8F2D44146315C67CF719737BC279AA4D203B7A93B4BAE713909B3B205
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads