Analysis
- max time kernel
148s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/10/2026, 05:44
Behavioral task
behavioral1
Sample
2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe
- Size 284KB
- Sample261024-gfmk5asxbs
- SHA256 fa2741e6aac51f5c1b59226afaa7050e30def93167375f6ad785873b9dd9b6d6
- MD5 8938d7856655a8c6e69aaae6aee6e113
- SHA1 6e6c498c2338f30fd9d5685f9c03a92a28568526
- SHA512 fd45df9fa363147a8e826f578b2702b72ebf6db44d39a0afc07cfc19b40abab75b19ddd805555dd81c17a02e50abbd283ff9d6dd4ca42843b846b81c7ee97756
- SSDEEP 6144:rFlKgzelZNQSBQGH/CSpWqTOoAXjiU4bzF:UfBQGH6SfaoAX+U41
- TLSH T1655402457D93C4B3D0414D3188E68BE18B7F6C137AA6E11BFB9D0B4B1EB13884BA6761
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x001500000001c4a2-3.dat family_cosmu behavioral2/files/0x000400000001bb7a-86.dat family_cosmu behavioral2/files/0x000600000001bb6b-184.dat family_cosmu behavioral2/files/0x000400000001bb7d-188.dat family_cosmu - Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\H: 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\I: 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\J: 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\K: 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\N: 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\O: 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\G: 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\L: 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\M: 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\readme.1xt 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX6261.tmp 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.cab 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX634B.tmp 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX61A7.tmp 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX6281.tmp 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.cab 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ieinstal.exe 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.cab 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX6161.tmp 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX62C2.tmp 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.cab 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX61B7.tmp 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX620B.tmp 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX61DB.tmp 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX621D.tmp 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.cab 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ieinstal.cab 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\RCX6318.tmp 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX605E.tmp 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\dotnet.cab 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\dotnet.exe 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX61EB.tmp 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX6292.tmp 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.cab 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX61A6.tmp 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX6250.tmp 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iexplore.exe 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX62F6.tmp 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.cab 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCX60A2.tmp 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX603A.tmp 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7zFM.cab 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX623E.tmp 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.cab 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCX635C.tmp 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCX6080.tmp 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX6307.tmp 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.cab 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_8938d7856655a8c6e69aaae6aee6e113_elex_rhadamanthys_smoke-loader.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4112
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 324KB
- SHA256 ecebcd40877a3399daebdc83a5aecf23b5a4dd278e3564393559e9e743af2077
- MD5 e08f6924c0ccba14b91c5548177a4adb
- SHA1 ae0b9ed56dff55a5df85bed50fc34dcd3a9c18a8
- SHA512 dd6c940647cd81c06eba3d5ee51daf8ec25d386c9a961c005065894c5febf9caaa1a9038f49096556ac6d0b74f9ca5b388d5d3590397078ac09cfda112eb8fe0
- SSDEEP 6144:YFlKgzelZNQSBQGH/CSpWqTyoAXjiU4bz:vfBQGH6SfeoAX+U4
- TLSH T12A64F1457D93C4B3E0414D31C9E68AE14B7E6C037AA6E11BFF5D0B4B1EB13884BA66B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX6291.tmp
- Size 284KB
- SHA256 66e314170bb61f05c9e6652c292d37b28cc3d610067278df8617a74dae23c03d
- MD5 f62c9f74d41ba6900fda57c6024fcc3d
- SHA1 5bf99f8be102024821db33debe65c7461484e77a
- SHA512 86ab7335b254fb45a50c49a42884c8e5aadd928f990cdb4c0c568b5be53dde6046cbe9d971ac053cd04b126cd42c00b85153c500cc346251958706d0b7974620
- SSDEEP 6144:QFlKgzelZNQSBQGH/CSpWqTfoAXjiU4bz:nfBQGH6SfzoAX+U4
- TLSH T1205402457D93D4B3D0414D3188E78BE18B7F6C137AA6E11BFB9D0B4B1EB13884BA6261
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX6292.tmp
- Size 284KB
- SHA256 7a9766fba8a79172aa31b4aead1b3ba381c11555e88eb6d302e9b124bf246d9c
- MD5 76024826ba839f10e3ced86eef7679c4
- SHA1 fa71eb2cd1226036bd34d2bce6e0c11c91563308
- SHA512 67c7db83fe7a82bb267fa2f7d0a561bf403a16c229e61ada403352b73d3f4d373b38993ab89285e713d011aacf30fbcdd11951ec192cae157abb4c592a93db7f
- SSDEEP 6144:YFlKgzelZNQSBQGH/CSpWqTZoAXjiU4bz:vfBQGH6Sf9oAX+U4
- TLSH T1685402457DA3C4B3D0414D3188E68BE19B7F6C137AA6E11BFB9D0B4B1EB13844B6A361
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\RCX6172.tmp
- Size 284KB
- SHA256 0e74ae0c31c17e3b8a2bc8e2dc6003a7a67d0b3c07181dec30b259d4f62f99f0
- MD5 b57d23e33b3dc73199a81d757029f1b8
- SHA1 46c5fe939c76c64a419df857ed5c003203976510
- SHA512 02e034471b34faf8145285000a76c43b69e345089dcf67793bc38b2d1f68d58532aab221a2cf8e8051eb7d69584619e8bbd724e88e01cd29c889a43f137fc92e
- SSDEEP 6144:EFlKgzelZNQSBQGH/CSpWqTAoAXjiU4bz:jfBQGH6Sf0oAX+U4
- TLSH T1E354F1457D93C4B3D0414D31C9E68BE14B7E6C037AA6E11BFB5D0B4B1EB13884BAA6B1
- MD5 SHA1 SHA512 SSDEEP TLSH