cosmu | b314fd7d74debf093ac40e2ff9e45dcd26e6526d0356ddfae325209e441a6361

Analysis

max time kernel
148s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/10/2026, 03:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe
Size 1.5MB
Sample261023-dkvwhscb57
SHA256 b314fd7d74debf093ac40e2ff9e45dcd26e6526d0356ddfae325209e441a6361
MD5 f0ba1145fa096c7b4c23c76161661c77
SHA1 f5853057e3066cdd4c50e69f77347741cc2aed6a
SHA512 3d3ed6f5c9d2f104523810ad34dd4a9edb46c68c51ca70794cfac54fceeb7db4465558cc6a8f640d27e733b26c1de0fcdbf8fc3316247f18a6f1f1d94586f7c4
SSDEEP 6144:SFlKgzelZNQSBQGH/CSpWqTPueF/mNyBXoAXjiU4bz:1fBQGH6SfKCBXoAX+U4
TLSH
T1E165CFB27B92C66BD4E7C23DB4458557A7F29B024D13926397A0EF3DCA392814DDCC42
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery cosmu worm

Malware Config

Signatures

Family: Cosmu
Cosmu is a Windows worm written in C++.
worm cosmu

Detects Cosmu payload 5 IoCs

Cosmu is a worm written in C++.

resource	yara_rule
behavioral2/files/0x000300000001b2cd-3.dat	family_cosmu
behavioral2/files/0x000b000000016b43-18.dat	family_cosmu
behavioral2/files/0x000400000001bb3f-87.dat	family_cosmu
behavioral2/files/0x000800000001bb2d-185.dat	family_cosmu
behavioral2/files/0x000400000001bb42-189.dat	family_cosmu

Enumerates connected drives 3 TTPs 10 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\O:	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\H:	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\K:	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\L:	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\D:	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\G:	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\I:	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\J:	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\M:	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\RCX6AC9.tmp	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Internet Explorer\iediagcmd.cab	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\RCX6C4C.tmp	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.cab	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Internet Explorer\iexplore.exe	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\RCX697F.tmp	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX69C2.tmp	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX6B43.tmp	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.cab	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.cab	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCX6AEF.tmp	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.cab	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\RCX6D60.tmp	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\readme.1xt	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\RCX6991.tmp	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCX6AC7.tmp	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCX6B01.tmp	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX6B98.tmp	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\7-Zip\7z.cab	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX6B54.tmp	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\7-Zip\7zFM.cab	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX69E4.tmp	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCX6B22.tmp	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.cab	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCX6AA6.tmp	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.cab	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\RCX6C7F.tmp	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7z.cab	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\7-Zip\7zFM.exe	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\dotnet\dotnet.cab	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCX6AF0.tmp	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCX6B32.tmp	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Internet Explorer\ExtExport.cab	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX6C29.tmp	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\RCX6C6E.tmp	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\RCX697E.tmp	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\RCX6C8F.tmp	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\RCX6CB0.tmp	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX6C3B.tmp	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\RCX69B2.tmp	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\dotnet\dotnet.exe	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCX6AC8.tmp	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_f0ba1145fa096c7b4c23c76161661c77_elex_rhadamanthys_smoke-loader.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4712

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 321KB
SHA256 8ba53ca4a26be14f8e87256c30f5fab3a28e9a231aef3e4f1d02bcda60f3e7b1
MD5 f28d108e0ad061bb2aed636e88c2b473
SHA1 50dea9ec262c275ecd2ce0b7a7793b1ddf1ecc71
SHA512 560e7a93e9158077461cbd9e77002fcb9c3bcc00e1c58dc0e690e5f359c2a7512957ffb41c8f30540ac1cf6c338572dc8ed47d10a39b4b5652f57c86309afe4b
SSDEEP 6144:8FlKgzelZNQSBQGH/CSpWqTyoAXjiU4bz:bfBQGH6SfeoAX+U4
TLSH
T15264F1457D93C4B3E0414D31C9E68AE14B7E6C037AA6E11BFF5D0B4B1EB13884BA66B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 325KB
SHA256 dac6f7f76943f1a6bac1c7e3e286e1ac9cdc0d8a2be5b435e24a7cea0eb3ab02
MD5 f6d3c7c2a7dbdf7fd5ba71fff3c6fdeb
SHA1 e7ce85557b7aa88edaa55b652981f046b0b8db4a
SHA512 48374b156decb26fe6887f0a89a60dfb8d174d36ff98ed989f2c18ea451862a1b1fc385de587c5c151d2c9f2a63f2f7f83a7c6b00b7506f48abeec142ac423f4
SSDEEP 6144:8FlKgzelZNQSBQGH/CSpWqTsoAXjiU4bz:bfBQGH6SfgoAX+U4
TLSH
T1F464F1453D93C8B3D04149318C96CBE15B7E7C13BEA5E117FB993B4F1EB13848AA6261
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX6BB9.tmp

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX6BB9.tmp
Size 284KB
SHA256 5448ae111e1b9b30409412eb42422e62726c5390adcb37bdac7f4578e46ba2a5
MD5 7cfee6e095fbfc4e76ceed173a0b4806
SHA1 7ec5f59303fe6d489523dedc791530f148fcf325
SHA512 473c683472f65267df44190ef5ec629e26803b377c5b3305d0ba429ee0295bbaabb40bb6cbe0d06b80fefc6aa5c09c23fdbe740c9a89ca19a9715ea5477dfcac
SSDEEP 6144:UFlKgzelZNQSBQGH/CSpWqTfoAXjiU4bz:TfBQGH6SfzoAX+U4
TLSH
T16B5402457D93D4B3D0414D3188E78BE18B7F6C137AA6E11BFB9D0B4B1EB13884BA6261
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX6BBA.tmp

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX6BBA.tmp
Size 284KB
SHA256 7a1f58964ef4162b6881cecf4b7b43ca1e2621efb1bd020ec8523da85022e15c
MD5 2a1a62a3e6010c7d200386e407ec2159
SHA1 3c13adb2b2d18f1e06e2c2d5b5cc41ba28bdef71
SHA512 048a91343e51d2e4710e4315f16119f40d38bf0d21ced31b055a8efa4541098cd8a6452bd506db924e50c2bf2768568a87df643811bb8ea185c4f7f39475ce9f
SSDEEP 6144:sFlKgzelZNQSBQGH/CSpWqTZoAXjiU4bz:rfBQGH6Sf9oAX+U4
TLSH
T1D95402457DA3C4B3D0414D3188E68BE19B7F6C137AA6E11BFB9D0B4B1EB13844B6A361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX6AC8.tmp

Path C:\Program Files\Google\Chrome\Application\RCX6AC8.tmp
Size 284KB
SHA256 b3486150e8e34eda63ae230e73e8fdd96d3669da20ebb35230a193eaacc51c18
MD5 228c5747aef16ec34ceae349aa704963
SHA1 2998daef65bfc4c369feb0596db89537ec13a7b8
SHA512 f368617cc60109982bbbd156638e7318ff962cbfce40016cdc879b103978e8966dcafe56eb699e6d6d9b296a3a2491bda8950ffcb659a6f9fb1c7570b6cd4d42
SSDEEP 6144:oFlKgzelZNQSBQGH/CSpWqTAoAXjiU4bz:ffBQGH6Sf0oAX+U4
TLSH
T14354F1457D93C4B3D0414D31C9E68BE14B7E6C037AA6E11BFB5D0B4B1EB13884BAA6B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads