cosmu | 0c1df523ca9eea9ddafa41b0bf00882e5f4a941391394a5e44056ff462a0bde3

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 07:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe
Size 288KB
Sample261024-h3qfzaee36
SHA256 0c1df523ca9eea9ddafa41b0bf00882e5f4a941391394a5e44056ff462a0bde3
MD5 7f122cedb4c81b1a7553a520f4e8b7a7
SHA1 b3e5fd627c66abaa2dff3372ea5fc471097a59cb
SHA512 8c8513a7f80245bb5e00d855728d191297a8bcd3fb11354613dac8575ffedf06b25608c1519fcb3af8dc1f47b156bed27b2420457e83b5f06f525e55bf6f3700
SSDEEP 6144:vFlKgzelZNQSBQGH/CSpWqTIoAXjiU4bzF:AfBQGH6SfcoAX+U41
TLSH
T14D5401917DA2D8B3C0419A318CA68BA197376D139A65D203FBAD1F4B2F713D49B7B301
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery cosmu worm

Malware Config

Signatures

Family: Cosmu
Cosmu is a Windows worm written in C++.
worm cosmu

Detects Cosmu payload 5 IoCs

Cosmu is a worm written in C++.

resource	yara_rule
behavioral2/files/0x000d00000001c651-3.dat	family_cosmu
behavioral2/files/0x000400000001bb66-86.dat	family_cosmu
behavioral2/files/0x000300000001bb6a-139.dat	family_cosmu
behavioral2/files/0x000c00000001c662-189.dat	family_cosmu
behavioral2/files/0x000300000001bb68-185.dat	family_cosmu

Enumerates connected drives 3 TTPs 10 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\H:	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\K:	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\L:	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\N:	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\D:	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\I:	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\J:	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\M:	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\O:	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\RCX7E1F.tmp	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\RCX8254.tmp	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.cab	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Internet Explorer\ieinstal.cab	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.cab	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX7F6F.tmp	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.cab	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX8212.tmp	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\RCX8266.tmp	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.cab	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\RCX829A.tmp	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\helper.cab	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX818B.tmp	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.cab	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Mozilla Firefox\crashreporter.cab	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\RCX7E31.tmp	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX7F90.tmp	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCX8020.tmp	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCX80D2.tmp	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.cab	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.cab	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Mozilla Firefox\default-browser-agent.cab	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\RCX82BC.tmp	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.cab	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX8244.tmp	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\RCX8289.tmp	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX81CF.tmp	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.cab	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\dotnet\RCX7FC0.tmp	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCX80D0.tmp	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX8243.tmp	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.cab	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\7-Zip\7zFM.cab	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCX8021.tmp	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCX8119.tmp	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCX813A.tmp	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Internet Explorer\iexplore.exe	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\extcheck.cab	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Java\jre-1.8\bin\jabswitch.cab	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\dotnet\RCX8000.tmp	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCX80F5.tmp	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\RCX7E43.tmp	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCX80BE.tmp	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7f122cedb4c81b1a7553a520f4e8b7a7_elex_rhadamanthys_smoke-loader.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 329KB
SHA256 25956e201364f82b9f926d43754950457c8636afe1bd261ad930b0a1c7c637c4
MD5 eba4e054259d3caf4568b813b6bc64ae
SHA1 ff8b316a9cbf0ad6f28237f970facf17c753dc4f
SHA512 07e0ced31b6bc3d801b28cb300925fa82b41132db266d2c2fc0425eaa29caf0818f1b3c905208588539a43d6eb9b66bbdbbec990d8a610fee2b63ecfba45fec0
SSDEEP 6144:OFlKgzelZNQSBQGH/CSpWqTvoAXjiU4bz:pfBQGH6SfboAX+U4
TLSH
T15A6401817DA3D8B3D041493188A6CBA1973B6D13AA65D203FB9D0F4B2FB13D49B7A351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX81F1.tmp

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX81F1.tmp
Size 288KB
SHA256 a1168790c99850ecd42bb12599fd757f5a4245e1e904c9f4054fbc06210392d4
MD5 adc913715a55fe3b12bec977f71d25d6
SHA1 602d737147c6e00383c043ae579424eb72478bd1
SHA512 b565c30d25c4ac62ac4ffadaa27fc8410d2957cf1b7c17817534ad0e7b75a785ac8c58754998e1b374f5753a0ce8a636f315cbcb7d803ab77c0a7228dcae6d3d
SSDEEP 6144:mFlKgzelZNQSBQGH/CSpWqTjoAXjiU4bz:BfBQGH6Sf3oAX+U4
TLSH
T1645401817DA2D8B3C4414A328CA78FA197376D139A65D203F7AD1F4B2F713D49B7A205
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX81F2.tmp

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX81F2.tmp
Size 288KB
SHA256 b52f5a7bb1297503373eaa16ed9081b288c66c3739eb54b7eb71d8a5a7250fbb
MD5 872c8ee36666eae86633be6b75e70bf9
SHA1 37fdf148d750b6c84298b0adfdd4be9c4ddf2fac
SHA512 2baa2c5cc6b723f15513e4d1ea013d635f4b0755770b1bbf434055c6023a3a26ecac184b800f1ab22174d5427369175a3ca4a13d9dc01bc98cbb3c91e2642c05
SSDEEP 6144:2FlKgzelZNQSBQGH/CSpWqTSoAXjiU4bz:xfBQGH6Sf+oAX+U4
TLSH
T1BF5401917EA2D8B3C0419A315CA68BA197377D139A65D203B7AD1F4B2F713D09B7A302
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX80D1.tmp

Path C:\Program Files\Google\Chrome\Application\RCX80D1.tmp
Size 288KB
SHA256 ce0fa3c35564d69ca6d5fdc9a8a52384290c50b0a350c4ff0989b15eddb664c3
MD5 9f44cf85200bab24f7d3f94ed21b8780
SHA1 32e4ed320c0277d414c2b06a88cdf3dd3ee314d5
SHA512 2ad691003d3ebabf7c6db1b4988a97ff9c936ed578861bbe5b957885fe70419ce88781b3f7111f8874b27f6464e568e175766cc25ac6d0705e704c512ac5068a
SSDEEP 6144:iFlKgzelZNQSBQGH/CSpWqTYoAXjiU4bz:lfBQGH6Sf8oAX+U4
TLSH
T1015401917DA2D8B3D041493188A68FA1973B6D13AA65D203FB9D0F4B2FB13D49B7B241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 329KB
SHA256 ac170be26ea0d7bdd608c317986b04d894bae3dbcbebb34f5508394d807b00a8
MD5 d08e33981173b5245f66287a4533b986
SHA1 e0addd0cd96ebfee61715e2dead9de5a897b7771
SHA512 6b8ed3e68538345a439fc078cc7546ed633ec7b6e69b50868387e0a659bf0a95ee83cf67c25fefb2d5cf03a1f6fe5b9d314498263cb8c865bda58d61a5a66439
SSDEEP 6144:2FlKgzelZNQSBQGH/CSpWqT8oAXjiU4bz:xfBQGH6SfYoAX+U4
TLSH
T1426401917EA2D8B3D0429A3148A68F6197377D139A65D203B7AD1F4B2F713D09B3B302
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads