Analysis
- max time kernel
148s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/10/2026, 15:23
Behavioral task
behavioral1
Sample
2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe
- Size 1.5MB
- Sample261025-sshcqahz9n
- SHA256 a5d5b6303441b1e49fb590ce60f76225b501e427f3c807e721e18da930d07eff
- MD5 89d321c7198e8ac01637c34151aedded
- SHA1 76a815c5802041172b38a539b5c3e780a0264790
- SHA512 76335ba16040f17184dea3e6593c7b35ad425c1116852441020588e0c9d61a85fa7cb3306bcd9f60d0d491299848398b789cfed3763c81b0b73547f0055ace11
- SSDEEP 6144:YFlKgzelZNQSBQGH/CSpWqTeoAXjiU4bz:vfBQGH6SfioAX+U4
- TLSH T18F7502457DA3D4B3D0414D3188E68BE18B7F6C137AA6E117FB9D0B4B1EB13844BAA361
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Cosmu payload 5 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000e00000001c490-3.dat family_cosmu behavioral2/files/0x000d00000001c49d-86.dat family_cosmu behavioral2/files/0x000300000001bb36-184.dat family_cosmu behavioral2/files/0x000d00000001c4a2-188.dat family_cosmu behavioral2/files/0x000300000001b94a-257.dat family_cosmu - Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\L: 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\M: 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\N: 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\D: 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\G: 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\O: 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\H: 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\I: 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\J: 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCX60B.tmp 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCX61C.tmp 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX7A9.tmp 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ExtExport.exe 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.cab 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome.cab 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX71E.tmp 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCXA0F.tmp 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7z.cab 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\dotnet.cab 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX72F.tmp 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.cab 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX5A4.tmp 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX797.tmp 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.cab 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.cab 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.cab 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX5D9.tmp 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCX63E.tmp 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.cab 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.cab 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX5B5.tmp 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX70B.tmp 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX70C.tmp 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.cab 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX81D.tmp 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.cab 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX7EA.tmp 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX5B6.tmp 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX5C7.tmp 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX70D.tmp 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.cab 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX7CA.tmp 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX977.tmp 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX9FD.tmp 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.cab 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX744.tmp 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.cab 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\crashreporter.cab 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCXA10.tmp 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7zFM.exe 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCX61D.tmp 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX9CB.tmp 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\dotnet.exe 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ielowutil.cab 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-24_89d321c7198e8ac01637c34151aedded_elex_rhadamanthys_smoke-loader.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3112
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 327KB
- SHA256 05fe768c7ca9c9c09bac3a974cd27a781b6f9016251780a2d0bf2d0bdd4aebce
- MD5 f17a968995f535e61a03f2795600f83e
- SHA1 57edab4304c00de53b47a78bc97402da23b559a5
- SHA512 498b52e6785123f6836ade646e9d760fb0ba3f1e675b7286d962625bdf6737943b5b0e4811ef789734f1a94c31b672b67e970f5f42e9d53db9e0b346344cc1c9
- SSDEEP 6144:qFlKgzelZNQSBQGH/CSpWqTyoAXjiU4bz:tfBQGH6SfeoAX+U4
- TLSH T1C864F1457D93C4B3E0414D31C9E68AE14B7E6C037AA6E11BFF5D0B4B1EB13884BA66B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX81D.tmp
- Size 284KB
- SHA256 f9cab91681691edc9fa0b73173be0a30f9129c0f5e68d23e3346dc6dc826fd54
- MD5 83c5b296f255844e43f2519bd4254389
- SHA1 98c43e41c7bb51c01c89923a98cc25a068016a79
- SHA512 2fb9c5d53ffcd2e6f373d744f6ebb5e6b0983efa0b3f4cbd58e432e2ff2b54676a72b0deb856657cb7c796863a31521b6df8561826c69057357ba1ed253dcf1f
- SSDEEP 6144:qFlKgzelZNQSBQGH/CSpWqTfoAXjiU4bz:tfBQGH6SfzoAX+U4
- TLSH T1765402457D93D4B3D0414D3188E78BE18B7F6C137AA6E11BFB9D0B4B1EB13884BA6261
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 1.5MB
- SHA256 5d587bb5de70f4348a6ad52eadd5c06f744f47cf5139484b78c50974c7a10203
- MD5 6e4042742aa1c2d4984b7f8e4c26e34f
- SHA1 a7a019ec9a234af418f4698ba17efcb0308bcb5a
- SHA512 574dad862e51b2249b79306e680b6715f0b97ae07e9573f8309aab7ee32b2fb36b82fb5f929b440fec6b873e7e169cee6db2618a0e7cdfd9ed36fd19f7e123a7
- SSDEEP 6144:CFlKgzelZNQSBQGH/CSpWqTZoAXjiU4bz:FfBQGH6Sf9oAX+U4
- TLSH T1E16502457DA3C4B3D0414D3188E68BE19B7F6C137AA6E11BFB9D0B4B1EB13844B6A361
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\RCX70D.tmp
- Size 284KB
- SHA256 acc37a9891b589fc9d907c54b0d6af61b4c6419fc65095b004814e4534059af0
- MD5 0f6fd059522017b0d15c7759f8e7973d
- SHA1 86f0a791885d267e245dff4a24680eccfc6c2e5c
- SHA512 b27026143995b7d4be521f457b6cd2318448e62010eb63bb5abff3159906ef8e651ab8a613237dda749468c43081aa3524c7a27fdde1ffc0ffe648fda0ef57b0
- SSDEEP 6144:GFlKgzelZNQSBQGH/CSpWqTAoAXjiU4bz:hfBQGH6Sf0oAX+U4
- TLSH T1D554F1457D93C4B3D0414D31C9E68BE14B7E6C037AA6E11BFB5D0B4B1EB13884BAA6B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\default-browser-agent.exe
- Size 284KB
- SHA256 71cbf42381155d99b6a2578904758282350860c1d788c36fe67458f7ba8b57cb
- MD5 58b2468767cc3b9b8f11b829efe71af8
- SHA1 a7395855edfad1d7f0c2569f439ada83517040f5
- SHA512 12ee22bca47d4ba7f7dee3eefb169e9d90026a10b0c79334a9f82e1103e9e719f522d01be363e720f12f1f17010776197e8bffa39f837e180fed205df93bb017
- SSDEEP 6144:aFlKgzelZNQSBQGH/CSpWqT4oAXjiU4bz9:9fBQGH6SfsoAX+U4N
- TLSH T1195402457D93D4B3D0414D3188E68BE18B7F6C137AA6E11BFB9D0B4B1EB13C84BA6261
- MD5 SHA1 SHA512 SSDEEP TLSH