Analysis
- max time kernel
148s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/10/2026, 04:34
Behavioral task
behavioral1
Sample
2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe
- Size 1.5MB
- Sample261024-e7f7bafx7s
- SHA256 b0c6c46acaf0dc1597c9ee7bcdd7b0b8ce72ec2dacd6e641ff66e80239246aaf
- MD5 9259ca69737bb26c337224f5b24e6862
- SHA1 91f0d67b1e62191f29eb464ff0ef578c8e5001af
- SHA512 3e14280b7f4f4d9f04e7bfd287f46859af3a3de7f5723f6d7c6a41dc7ee4538d1a9a3ce854d7c4d59185c00afab0360138f223635d08438e1d034cebe8519467
- SSDEEP 6144:bFlKgzelZNQSBQGH/CSpWqTeoAXjiU4bz:kfBQGH6SfioAX+U4
- TLSH T1F36502457DA3D4B3D0414D3188E68BE18B7F6C137AA6E117FB9D0B4B1EB13844BAA361
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000f00000001c498-3.dat family_cosmu behavioral2/files/0x000400000001bb65-86.dat family_cosmu behavioral2/files/0x000700000001bb53-184.dat family_cosmu behavioral2/files/0x000300000001bb67-188.dat family_cosmu - Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\H: 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\I: 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\J: 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\K: 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\O: 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\D: 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\L: 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\M: 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\N: 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCX98DA.tmp 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX983F.tmp 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX973E.tmp 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ieinstal.exe 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX9850.tmp 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.cab 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.cab 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iediagcmd.cab 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iexplore.cab 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX9851.tmp 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\RCX98A4.tmp 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.cab 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\dotnet.cab 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCX964C.tmp 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCX98D8.tmp 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.cab 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCX98D9.tmp 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX972C.tmp 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX97B7.tmp 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX981D.tmp 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ielowutil.cab 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX9893.tmp 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCX966C.tmp 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX972B.tmp 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX9862.tmp 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7zFM.cab 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ExtExport.cab 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.cab 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7z.cab 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\dotnet.exe 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX9786.tmp 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ielowutil.exe 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX9753.tmp 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.cab 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.cab 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7zFM.cab 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCX963A.tmp 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX973F.tmp 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.cab 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.cab 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX97DA.tmp 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.cab 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCX966D.tmp 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX9750.tmp 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX97EA.tmp 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.cab 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ieinstal.cab 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_9259ca69737bb26c337224f5b24e6862_elex_rhadamanthys_smoke-loader.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4340
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 326KB
- SHA256 a289a72d5ed45dd1734145d509ec8fe2bfe973167e5fc46c615975d8f6433b9f
- MD5 583907a2e67f21b42fa8fda85d0c4c8e
- SHA1 792b750d0c54f881cae5361886737176abe86238
- SHA512 667466a6bc8f83b9d24e35619f798eb7f2e1aa6b1b68acd07436f118ade17e7bde1ce32bc3bd548b3a719c6dd51155d3193214388ed474c47f69bf9e14849d9b
- SSDEEP 6144:eFlKgzelZNQSBQGH/CSpWqTyoAXjiU4bz:ZfBQGH6SfeoAX+U4
- TLSH T1DE64F1457D93C4B3E0414D31C9E68AE14B7E6C037AA6E11BFF5D0B4B1EB13884BA66B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX981D.tmp
- Size 284KB
- SHA256 9a87ebe6aeb4ebdaf9774206b44050477fa1e3d3fc5a52aa52e7dbdb61552fc9
- MD5 966b5c689e73405e1ddaadf88b288fe6
- SHA1 6d81ffe8d279dd608e54bfdabb5b2fe9eff7d03f
- SHA512 6230dc1e70a22113585a89219ed51f2b45886087f6cc4bf2d01fe022f32ab9439763241d24c015e23d0deb2f3e34f54694c2de791ed8eb5e99596c75b6dfdc1e
- SSDEEP 6144:+FlKgzelZNQSBQGH/CSpWqTfoAXjiU4bz:5fBQGH6SfzoAX+U4
- TLSH T1485402457D93D4B3D0414D3188E78BE18B7F6C137AA6E11BFB9D0B4B1EB13884BA6261
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX981E.tmp
- Size 284KB
- SHA256 4861729a70f254aa909361f8a8abbef6c956eb8729754e25440f79fb54200c77
- MD5 5e67b9fe5f8c04f298ff3c7825d2a7c2
- SHA1 965c05e8cdf8d845f6d2e2ed81207f0b7f8efe62
- SHA512 3b5c1524e60af63a90a96dd5e614ca819b02d38bc5d9a5def068d5753789b4028faf2c194d2e8c5960c976ea2b30cdd1dfff76ac316ebfa668b3d2afc0f6f324
- SSDEEP 6144:WFlKgzelZNQSBQGH/CSpWqTZoAXjiU4bz:RfBQGH6Sf9oAX+U4
- TLSH T1305402457DA3C4B3D0414D3188E68BE19B7F6C137AA6E11BFB9D0B4B1EB13844B6A361
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\RCX972D.tmp
- Size 284KB
- SHA256 f68dafe06019828de86de92b89fb1d584ca06f4dd24ed0464cbbaf8df6f44772
- MD5 e0ed6d4b43ea244b1a191b4cd26aace7
- SHA1 2739aa43d9b62152dffcef39f1e5470791df5f65
- SHA512 a4e55597bf2951312af80c06f7cf2b71ce055e760c0554435041086e68752008381847cf24cd0a9b0c87ee64f6a9699e9359ce24604f0e9d05ea03ada6d86dcb
- SSDEEP 6144:6FlKgzelZNQSBQGH/CSpWqTAoAXjiU4bz:dfBQGH6Sf0oAX+U4
- TLSH T1BB54F1457D93C4B3D0414D31C9E68BE14B7E6C037AA6E11BFB5D0B4B1EB13884BAA6B1
- MD5 SHA1 SHA512 SSDEEP TLSH