Analysis
- max time kernel
148s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/10/2026, 19:09
Behavioral task
behavioral1
Sample
2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe
- Size 284KB
- Sample261023-xt58dsdt2x
- SHA256 cf0cbc21a2111e5ed52295d35587d892c9112ddcd47991822ca1da57a9a306bb
- MD5 d335adad023e88c4ebebfc51e99a0416
- SHA1 cf83c90958cf4e30a252d36ccd17b0b30bf6d2cd
- SHA512 9695b23260e43f131c557da61ad6653d6a1ac8baf38c03c19af0b4db10887e27d42cade1daed36c37dbd72deada113d7e59364021e3b028db86d1c7e83692549
- SSDEEP 6144:rFlKgzelZNQSBQGH/CSpWqTkoAXjiU4bzN:UfBQGH6SfIoAX+U49
- TLSH T1A35402457D93C4B3D0414D3188E68BE19B7F6C137AA6E11BFB9D0B4B1EB13844BAA361
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000e00000001c563-3.dat family_cosmu behavioral2/files/0x000d00000001c56e-86.dat family_cosmu behavioral2/files/0x000300000001bb7c-182.dat family_cosmu behavioral2/files/0x000400000001bb7d-188.dat family_cosmu - Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\L: 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\N: 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\O: 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\H: 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\J: 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\M: 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\D: 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\G: 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\I: 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\extcheck.cab 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX214C.tmp 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX1ED8.tmp 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX1F23.tmp 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.cab 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ielowutil.exe 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.cab 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX1EFD.tmp 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX1F10.tmp 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX1FA2.tmp 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX2108.tmp 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCX1E4A.tmp 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX1EFF.tmp 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX20C6.tmp 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCX2190.tmp 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7z.cab 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX216F.tmp 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\readme.1xt 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7zFM.exe 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX1DD2.tmp 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\dotnet.exe 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.cab 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX20D6.tmp 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX1DC1.tmp 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCX1E3A.tmp 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX1EFC.tmp 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.cab 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX2002.tmp 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ExtExport.exe 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.cab 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.cab 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.cab 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX20F7.tmp 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.cab 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX2013.tmp 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7z.exe 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX1DF4.tmp 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX1EEA.tmp 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\dotnet.cab 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX1DD3.tmp 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX2001.tmp 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome.cab 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX1ED9.tmp 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_d335adad023e88c4ebebfc51e99a0416_elex_rhadamanthys_smoke-loader.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4608
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 331KB
- SHA256 f6fbdc0d4eac3fd261d6bb1a7513661e045fa774b8a7a3505a127e5a75a09c7d
- MD5 8faa1092fa99b50204c1046ee955b4c9
- SHA1 d74cc6d7f338929031ae87dc32ff476f5a259dac
- SHA512 af070f461d1ac6c9db868699c3cb5cde7587ea408621435b595b9cb479cc0c08e3a66e70a728ab24e7c0e6dfd5532cfdcd8ce2aa678c94620003524a4cf865a3
- SSDEEP 6144:YFlKgzelZNQSBQGH/CSpWqTyoAXjiU4bz:vfBQGH6SfeoAX+U4
- TLSH T17C74F1457D93C4B3E0414D31C9E68AE14B7E6C037AA6E11BFF5D0B4B1EB13884BA66B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX20C6.tmp
- Size 284KB
- SHA256 66e314170bb61f05c9e6652c292d37b28cc3d610067278df8617a74dae23c03d
- MD5 f62c9f74d41ba6900fda57c6024fcc3d
- SHA1 5bf99f8be102024821db33debe65c7461484e77a
- SHA512 86ab7335b254fb45a50c49a42884c8e5aadd928f990cdb4c0c568b5be53dde6046cbe9d971ac053cd04b126cd42c00b85153c500cc346251958706d0b7974620
- SSDEEP 6144:QFlKgzelZNQSBQGH/CSpWqTfoAXjiU4bz:nfBQGH6SfzoAX+U4
- TLSH T1205402457D93D4B3D0414D3188E78BE18B7F6C137AA6E11BFB9D0B4B1EB13884BA6261
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX20D6.tmp
- Size 284KB
- SHA256 7a9766fba8a79172aa31b4aead1b3ba381c11555e88eb6d302e9b124bf246d9c
- MD5 76024826ba839f10e3ced86eef7679c4
- SHA1 fa71eb2cd1226036bd34d2bce6e0c11c91563308
- SHA512 67c7db83fe7a82bb267fa2f7d0a561bf403a16c229e61ada403352b73d3f4d373b38993ab89285e713d011aacf30fbcdd11951ec192cae157abb4c592a93db7f
- SSDEEP 6144:YFlKgzelZNQSBQGH/CSpWqTZoAXjiU4bz:vfBQGH6Sf9oAX+U4
- TLSH T1685402457DA3C4B3D0414D3188E68BE19B7F6C137AA6E11BFB9D0B4B1EB13844B6A361
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\RCX1EEB.tmp
- Size 284KB
- SHA256 0e74ae0c31c17e3b8a2bc8e2dc6003a7a67d0b3c07181dec30b259d4f62f99f0
- MD5 b57d23e33b3dc73199a81d757029f1b8
- SHA1 46c5fe939c76c64a419df857ed5c003203976510
- SHA512 02e034471b34faf8145285000a76c43b69e345089dcf67793bc38b2d1f68d58532aab221a2cf8e8051eb7d69584619e8bbd724e88e01cd29c889a43f137fc92e
- SSDEEP 6144:EFlKgzelZNQSBQGH/CSpWqTAoAXjiU4bz:jfBQGH6Sf0oAX+U4
- TLSH T1E354F1457D93C4B3D0414D31C9E68BE14B7E6C037AA6E11BFB5D0B4B1EB13884BAA6B1
- MD5 SHA1 SHA512 SSDEEP TLSH