Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/10/2026, 03:04
Behavioral task
behavioral1
Sample
2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe
- Size 292KB
- Sample261024-dkqlssht8j
- SHA256 2df47c4bdfea8719fba801f193c91a6fc7fcede4f43da2658c5c70d511fd41c5
- MD5 9d03d423abdac6b5a3381e871499f7ff
- SHA1 fbb2c316d1320984cb477bfcaa1aad0e624a2e8d
- SHA512 e7854592607cc9303c2bec87e2377888076ed43735432a92b96be8df5b60f37ad0d7cb89b9944c0ec83075430a4f423f1cd5f029b478c3825f48a31d0fad8975
- SSDEEP 6144:9FlKgzelZNQSBQGH/CSpWqTSoAXjiU4bzd:afBQGH6SfOoAX+U4t
- TLSH T16E54F2453D53D873E041493189E6CAE14B7F6C1376A2E21BFB981F4B1EF13885AAA271
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000d00000001c5be-3.dat family_cosmu behavioral2/files/0x000c00000001c5cb-86.dat family_cosmu behavioral2/files/0x000300000001bb46-184.dat family_cosmu behavioral2/files/0x000c00000001c5cf-188.dat family_cosmu - Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\G: 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\H: 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\J: 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\K: 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\M: 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\N: 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\O: 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\I: 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\L: 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.cab 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX602E.tmp 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.cab 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX5FFB.tmp 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.cab 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCX5E4E.tmp 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX5F73.tmp 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX5F95.tmp 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.cab 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX6107.tmp 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCX5E4D.tmp 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.cab 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.cab 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.cab 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX6108.tmp 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7zFM.cab 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\crashreporter.cab 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\readme.1xt 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCX5E80.tmp 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX5F61.tmp 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX5FB9.tmp 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX609F.tmp 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.cab 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iexplore.cab 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.cab 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.cab 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX5DE7.tmp 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.cab 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX60D4.tmp 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX5E1A.tmp 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX5F5E.tmp 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX60B0.tmp 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.cab 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7z.cab 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\dotnet.exe 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX5FD9.tmp 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX60D3.tmp 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX5DF8.tmp 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX5E1B.tmp 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_9d03d423abdac6b5a3381e871499f7ff_elex_rhadamanthys_smoke-loader.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:6004
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 326KB
- SHA256 10273ddf346b5bc845bfa4dfdd41298ff6ad5dccb1c54082b932c69df465c5ae
- MD5 7ce2b96c001a4e1e9a5b4bb093092df3
- SHA1 ce63ea0b671805b1b71056f9274c6d8cc44a0a5d
- SHA512 f1151580ac7a4b4916b201e7f92397c3b64b322cca328425880232e1ee2ebef3a12c461a0ac411f50b93698621268e390772bf4795152e5ac34c8381d02aa092
- SSDEEP 6144:/FlKgzelZNQSBQGH/CSpWqTyoAXjiU4bz:wfBQGH6SfeoAX+U4
- TLSH T19164F1457D93C4B3E0414D31C9E68AE14B7E6C037AA6E11BFF5D0B4B1EB13884BA66B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX604F.tmp
- Size 284KB
- SHA256 126bd3f8f95ea46137be9968db347dc3d2b7f95d18c20451f44bdfef4c8f722e
- MD5 072b4af6cd65df19664417ddfb7b99cb
- SHA1 0cb50fd3ae22121ab883cc2adc49e9fb937dd0c1
- SHA512 21ef8eb4611b7efabe1413a8d585f70fce1545454c84de8e03f60e8164038a626afae96b47d72914910f1ed59aa0cb96135b8753ed943aa3ec91ab44e2ed9799
- SSDEEP 6144:vFlKgzelZNQSBQGH/CSpWqTfoAXjiU4bz:AfBQGH6SfzoAX+U4
- TLSH T1D15402457D93D4B3D0414D3188E78BE18B7F6C137AA6E11BFB9D0B4B1EB13884BA6261
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX6050.tmp
- Size 284KB
- SHA256 1eec7658e1d81a4b516dcaed51e29765a6116f8aaf50ec2af7cb67bab647db8d
- MD5 88387903612eaec12da0ca34a35caec9
- SHA1 e3f5702cf193c58e0407e4079d54a595b32e1a8a
- SHA512 9619d2fc7ba87dfd0e85e3342ad4dee6c3d90dee77c8a93a7a12003dfdfa2ba2b6963ae8232f62889701a61326dad0b0a5e2d8efdefd7222488a03f61ccb7e3c
- SSDEEP 6144:PFlKgzelZNQSBQGH/CSpWqTZoAXjiU4bz:gfBQGH6Sf9oAX+U4
- TLSH T1165402457DA3C4B3D0414D3188E68BE19B7F6C137AA6E11BFB9D0B4B1EB13844B6A361
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\RCX5F5F.tmp
- Size 284KB
- SHA256 925836dd7701168f6c4c338d3a51590e79b9a32704b8f4cb3c73f3fc1e831a2f
- MD5 cb59d8880230d62ebbaa62d69842ec58
- SHA1 42fbfc2a16e959b34d2103d50272f0337c5963f2
- SHA512 d4ecbef9f0538e7f004bb7690133d543ce376efe89c04a9d936bf66904f328f0c034a260ceb22ff226aa4e94e970de93f17273935d19f6f38727d08c1ff90c30
- SSDEEP 6144:bFlKgzelZNQSBQGH/CSpWqTAoAXjiU4bz:kfBQGH6Sf0oAX+U4
- TLSH T14954F1457D93C4B3D0414D31C9E68BE14B7E6C037AA6E11BFB5D0B4B1EB13884BAA6B1
- MD5 SHA1 SHA512 SSDEEP TLSH