cosmu | 2b8d0c77e4d31f572f1f5538942ff5495b662449201e473bbac08772ae9dad8a

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 11:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe
Size 1.5MB
Sample261024-ntlpbabv6l
SHA256 2b8d0c77e4d31f572f1f5538942ff5495b662449201e473bbac08772ae9dad8a
MD5 5e7e4e8b39737b0672515267ef010577
SHA1 4cfc195fa50d81e375b997fded08b8a91bd06752
SHA512 932def4442219d801c4bd02425fce289448d3fea17f11c223d133bbc2d7af4f85dd473c6f7718b0b3067760ce83ea535d17d30210dc1f2fafabb9ccb1e30e2c5
SSDEEP 6144:vFlKgzelZNQSBQGH/CSpWqTdoAXjiU4bz:AfBQGH6SfJoAX+U4
TLSH
T1686501817AA2D8B3D4429A314CA6CF6197377D139A65D203B7AD1F4B2F713D09B7A302
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery cosmu worm

Malware Config

Signatures

Family: Cosmu
Cosmu is a Windows worm written in C++.
worm cosmu

Detects Cosmu payload 6 IoCs

Cosmu is a worm written in C++.

resource	yara_rule
behavioral2/files/0x000e00000001c4c9-3.dat	family_cosmu
behavioral2/files/0x000400000001bb27-86.dat	family_cosmu
behavioral2/files/0x000400000001bb2a-188.dat	family_cosmu
behavioral2/files/0x000300000001bb29-184.dat	family_cosmu
behavioral2/files/0x0005000000018975-200.dat	family_cosmu
behavioral2/files/0x0004000000019b63-222.dat	family_cosmu

Enumerates connected drives 3 TTPs 10 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\J:	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\K:	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\M:	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\N:	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\L:	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\O:	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\D:	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\G:	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\H:	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.cab	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\RCX3697.tmp	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Java\jre-1.8\bin\java-rmi.cab	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.cab	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX3601.tmp	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\RCX32A0.tmp	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\RCX32A1.tmp	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCX357A.tmp	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.cab	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCX34A1.tmp	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Internet Explorer\ieinstal.cab	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX32D4.tmp	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\RCX36DA.tmp	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCX3544.tmp	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX35DE.tmp	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.exe	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\RCX36C9.tmp	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\RCX36FF.tmp	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX32E6.tmp	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCX3543.tmp	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX35DF.tmp	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX3613.tmp	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCX3577.tmp	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\dotnet\dotnet.cab	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX3666.tmp	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\RCX32A2.tmp	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.cab	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCX3531.tmp	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.cab	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCX3578.tmp	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX35F0.tmp	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Internet Explorer\iexplore.exe	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\RCX36D9.tmp	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\RCX36FD.tmp	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\RCX328F.tmp	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\dotnet\RCX3345.tmp	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX3612.tmp	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.cab	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.cab	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.cab	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\RCX36B7.tmp	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX32D5.tmp	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCX359B.tmp	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_5e7e4e8b39737b0672515267ef010577_elex_rhadamanthys_smoke-loader.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 333KB
SHA256 ce4d100322fd9757760a70b1016e56fd34b86baf73545667dc7692674e2aa467
MD5 fc12c6c4537312cc48200b6f4e519d80
SHA1 a461adaa1114bbf0c0b1ddfcbe0cbe1f5d2d6930
SHA512 7311b7815506ed504ff19c6b8e234b31df9f6c10d170ff56a71a32f4615ee290c36c8cca4b7a2446befc72a6d75c72c502250b02f5e2221e6265d2d23f57823c
SSDEEP 6144:8FlKgzelZNQSBQGH/CSpWqTvoAXjiU4bz:bfBQGH6SfboAX+U4
TLSH
T1A77401817DA3D8B3D041493188A6CBA1973B6D13AA65D203FB9D0F4B2FB13D49B7A351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX3613.tmp

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX3613.tmp
Size 288KB
SHA256 80175eb607504ccd513b3f0d4c7a106367d752f8f212a4d91dfc7005b3ac6772
MD5 6e65f0157509816e6416d1087e71a98e
SHA1 5e16b7705380cbd5b9187b7979bc5b963fbc810d
SHA512 bc7ee69a5cddf97225956746b6d1c54fd5e56b79b5052d4a00bbf3b3d9f75ca80b1801120112b7aa2a97ba526cf2909e406ab7c97cbf4841e0f4e4cc9eb24974
SSDEEP 6144:0FlKgzelZNQSBQGH/CSpWqTjoAXjiU4bz:zfBQGH6Sf3oAX+U4
TLSH
T1885401817DA2D8B3C4414A3288A78FA197376D139A65D203F7AD1F4B2F713D49B7A205
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX3614.tmp

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX3614.tmp
Size 288KB
SHA256 7d309a247f070883ef65f1dd3550e71adf2f5bdc57160983322e81bb0aab5766
MD5 56f6dcc7162c529d0920e4a0401ec9df
SHA1 f1f385ee0e3acf6e12926af963561696fbb8906c
SHA512 36e180542b9cd16124662b4b9ff63caeaebb5f8ba15ac4b9bd741bccbcf54afe4a886ec08b2128be4efc0b18795d2ab2375bea63d80688c89087f3cd895ee212
SSDEEP 6144:cFlKgzelZNQSBQGH/CSpWqTSoAXjiU4bz:7fBQGH6Sf+oAX+U4
TLSH
T1A95401917EA2D8B3C0419A315CA68BA197377D139A65D203B7AD1F4B2F713D09B7A302
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX3532.tmp

Path C:\Program Files\Google\Chrome\Application\RCX3532.tmp
Size 288KB
SHA256 b21dbbb8e7ee9961ae26de65555c833755515c75db89ab7f087581a04dbbb81d
MD5 a0d925cc620b3b18ebfa488c6c555977
SHA1 b4058051332f5977d3e803ab50e56ed921af71c1
SHA512 88ca1638e63a3a44de17aab8fa7886af136fae7f6e749848c028713db73469c573e9604ba0a2902c9c72130853ab3a3f53cbf98250179522f0bff4b3f0978cfb
SSDEEP 6144:YFlKgzelZNQSBQGH/CSpWqTYoAXjiU4bz:vfBQGH6Sf8oAX+U4
TLSH
T1275401917DA2D8B3D041493188A6CFA1973B6D13AA65D203FB9D0F4B2FB13D49B7B241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 288KB
SHA256 0f6a99a54ae60ec46ab258fd485f00fb07701030645b46a1b8400fc4e1fa1cfe
MD5 5b1ee3492828448e3ed483c5e8a06815
SHA1 ac88fbe69f58ba18e38ab0dd46ea694a5a1616f3
SHA512 da43017c8a073f0cacc30a37b777926a886b6c3eadcd6f2ca6ef52dd385574523f4199c14ab2ecf7b590bf5e55bb31b5c5f9f0251ae729ea2739984927f672ee
SSDEEP 6144:0FlKgzelZNQSBQGH/CSpWqTaoAXjiU4bz9:zfBQGH6Sf2oAX+U4N
TLSH
T1EA5401917DA2D8B3C0419A318CA68BA197376D139A65D203FBAD1F4B2F713D49B7B301
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jre-1.8\bin\jabswitch.exe
Size 288KB
SHA256 1740f43e5a6b22770e49e7fe1bc3ad660280262e7635798845bce40cd7a388d4
MD5 7b7fb97613e14b7023173a37b253dfea
SHA1 e6c9186c607ce94f2ff9ffcbbadc27837f81b9cb
SHA512 778fc29104cbec1b9604e75d5385661981fa572b8d0f772a2ea0cd90855271dc0214e5a2a22690fa7d74b0a90e327d9883348add907d365082d9a8ebf72eaae3
SSDEEP 6144:0FlKgzelZNQSBQGH/CSpWqTJoAXjiU4bz9:zfBQGH6SftoAX+U4N
TLSH
T1185401917DA2D8B3C0419A314CA6CBA197376D139A65D203BBAD1F4B2F713D49B7B302
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads