Analysis
- max time kernel
148s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/10/2026, 07:11
Behavioral task
behavioral1
Sample
2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe
- Size 288KB
- Sample261024-hz529aee29
- SHA256 9bcd4c6a022eb20dba1852c1596e907ea4b02d429b5e61a0893926ac3137848a
- MD5 7fbf2514e2e310de5406651ceedf3108
- SHA1 745f186f7379808dfcd321df6469b50c3c97f475
- SHA512 509791a1b29993ec7f5e784f8fd93b1acdc5f8f005662bb5f19ca55fa9cc51e27ca3dc1cf1c8f288f647e768c702a7b7c94c2f5b7769d204028236399be299b4
- SSDEEP 6144:9FlKgzelZNQSBQGH/CSpWqTgoAXjiU4bzF:afBQGH6Sf0oAX+U41
- TLSH T17054F1457DA3C8B3D04149318CA6CBE1577A7C13AE65E207FB993F4F2EB13848B6A251
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000e00000001c56c-3.dat family_cosmu behavioral2/files/0x000400000001bb7a-86.dat family_cosmu behavioral2/files/0x000300000001bb7c-184.dat family_cosmu behavioral2/files/0x000d00000001c58b-188.dat family_cosmu - Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\K: 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\L: 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\N: 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\D: 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\G: 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\I: 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\J: 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\M: 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\O: 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX5A99.tmp 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ExtExport.exe 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ieinstal.exe 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX5B70.tmp 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX5B94.tmp 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.cab 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCX592F.tmp 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX5B1F.tmp 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX5C07.tmp 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7z.cab 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCX591E.tmp 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.cab 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX5B60.tmp 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX58FC.tmp 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ExtExport.cab 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7z.cab 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX5899.tmp 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX5A89.tmp 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.cab 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ielowutil.exe 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX5B93.tmp 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7zFM.cab 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7zFM.exe 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX58AA.tmp 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX5A65.tmp 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX5BA4.tmp 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX5888.tmp 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCX5CE4.tmp 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome.cab 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iediagcmd.cab 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX5C08.tmp 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCX5940.tmp 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX5A11.tmp 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX5A00.tmp 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX5A23.tmp 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX58CB.tmp 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.cab 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\dotnet.exe 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX5A66.tmp 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.cab 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iexplore.cab 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\RCX5BB6.tmp 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX5A01.tmp 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7fbf2514e2e310de5406651ceedf3108_elex_rhadamanthys_smoke-loader.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3944
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 324KB
- SHA256 da49a931f543e117b9fc3adbe2977c94db71e7b5d4e2348a06f74eb55ba1d870
- MD5 88b3bb090314e8b783ffdda2ececaaa7
- SHA1 b8dbd6767ac87032dbe37bb9cee55d25e26c686c
- SHA512 f65b28429c16ced82df3830092bb1d27d5f82ad778bb976267ccfaa9fc0c4397cef049408e4d6577bc086d58d1ea556f00b8c40dd9ef8a8e01f7d021be7560ca
- SSDEEP 6144:qFlKgzelZNQSBQGH/CSpWqTyoAXjiU4bz:tfBQGH6SfeoAX+U4
- TLSH T1DD64F1457D93C4B3E0414D31C9E68AE14B7E6C037AA6E11BFF5D0B4B1EB13884BA66B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX5B1F.tmp
- Size 284KB
- SHA256 d34906d1e8fd472a739ab92e57e7067e13f0165833ca45814575ecc788a3069f
- MD5 a020dc5e2bb713569d16f533895039be
- SHA1 8aab46487c62d11f8d1351a66454f87407b9708f
- SHA512 838027c3e88f872be0b1a0ad638b202345c53d0313aee728987f81821f255881236c57485b5307bceb4f8052ea0ccf6b356fadfcda3f773cc75402f87a132d56
- SSDEEP 6144:qFlKgzelZNQSBQGH/CSpWqTfoAXjiU4bz:tfBQGH6SfzoAX+U4
- TLSH T10A5402457D93D4B3D0414D3188E78BE18B7F6C137AA6E11BFB9D0B4B1EB13884BA6261
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX5B20.tmp
- Size 284KB
- SHA256 8089d2be11b4a71368f080cc0738f474449223b8489bfbb425484935b9e45158
- MD5 704193208573728dd443db2010dbf027
- SHA1 01b15cacfa26383eb3b9ebc914145b85a33f9fe8
- SHA512 e5caaecc967f9558e4eeed1e870b7e490da8c6c1059eef4a306fe20e8f0a57117d4744daff2cec79a281f5244e8e80d44bf3bca2343c45ed18145a2c5bddd093
- SSDEEP 6144:CFlKgzelZNQSBQGH/CSpWqTZoAXjiU4bz:FfBQGH6Sf9oAX+U4
- TLSH T1E95402457DA3C4B3D0414D3188E68BE19B7F6C137AA6E11BFB9D0B4B1EB13844B6A361
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\RCX5A00.tmp
- Size 284KB
- SHA256 c961b1f2c067198f92dc767f272f2ea99a48a45600ae80f4b88f0586c9907c29
- MD5 f516b7ba11be4a695842978a3a5b62f7
- SHA1 fc893d2d58d1771d02700fbd196db81c407fe4d6
- SHA512 512438633e59f9bd2bf584d8b7cd6603ee0ff46728da27b45f20e79a84f8a5e03236da430a1addbfa3eecf68e68e4a7c83a77ede1cc650d08dbe2c4f7ea64313
- SSDEEP 6144:GFlKgzelZNQSBQGH/CSpWqTAoAXjiU4bz:hfBQGH6Sf0oAX+U4
- TLSH T19654F1457D93C4B3D0414D31C9E68BE14B7E6C037AA6E11BFB5D0B4B1EB13884BAA6B1
- MD5 SHA1 SHA512 SSDEEP TLSH