Analysis
- max time kernel
148s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/10/2026, 05:58
Behavioral task
behavioral1
Sample
2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe
- Size 339KB
- Sample261027-gpmx9a1yht
- SHA256 1c898f2645054c356a68b31547418f862be675ac5bbc0ce020d0786ae939de57
- MD5 d37ace8d473cf2a0faf4ec17d28d1152
- SHA1 f679d22d9ae5d64dc78008bd9fa663e1c3561207
- SHA512 5ded4a4f908ca85ed2cd9423556f822354e740ce6baf8ef76eba8d80d28661fc210519af7698a43d13924599c0cb4ba0c0a4cc5c8e796e4c2433a271996d440a
- SSDEEP 6144:PFlKgzelZNQSBQGH/CSpWqTIToAXjiU4bz:gfBQGH6SfcToAX+U4
- TLSH T17B74F245FDA3C8B3D041493188E68BE14B7E7C03F5A6E11BFB991F4B1EB13948B66261
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000e00000001c521-3.dat family_cosmu behavioral2/files/0x000d00000001c52c-86.dat family_cosmu behavioral2/files/0x000300000001baf7-184.dat family_cosmu behavioral2/files/0x000e00000001c53d-188.dat family_cosmu - Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\I: 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\J: 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\L: 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\M: 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\O: 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\D: 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\K: 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\N: 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\G: 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\dotnet.exe 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX52C1.tmp 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\dotnet.cab 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCX5038.tmp 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.cab 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.cab 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.cab 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX50FA.tmp 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.cab 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7z.cab 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7z.exe 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\dotnet.cab 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX50F9.tmp 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX51C7.tmp 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX51D9.tmp 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.cab 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCX5016.tmp 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX510C.tmp 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.cab 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX51B5.tmp 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.cab 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.cab 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX526C.tmp 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX5140.tmp 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.cab 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7zFM.exe 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX50E7.tmp 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX51B6.tmp 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCX5015.tmp 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX5162.tmp 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX5172.tmp 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCX52D2.tmp 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.cab 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ielowutil.cab 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX5209.tmp 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.cab 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX4FE3.tmp 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX5173.tmp 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCX52D3.tmp 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX511F.tmp 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.cab 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\readme.1xt 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-26_d37ace8d473cf2a0faf4ec17d28d1152_elex_rhadamanthys_smoke-loader.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2444
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 322KB
- SHA256 4ed8b99796157bad0618ea9075b683ebdf57c9f490014314480c5e46b5e89658
- MD5 f7ee28f5cc9b9bb46f491a432044080b
- SHA1 e04d1b3ce1e4fb36def4877b5d01108a079e45de
- SHA512 ac8e8f72cb40bf07c448b67f9134eac84ff696646bd7b5881a51f4cd7f9ba75c4e51f7c1b8b818ee400b546161c0b367cfebc12bfd9a36c73475aa155303a611
- SSDEEP 6144:OFlKgzelZNQSBQGH/CSpWqTyoAXjiU4bz:pfBQGH6SfeoAX+U4
- TLSH T1AF64F1457D93C4B3E0414D31C9E68AE14B7E6C037AA6E11BFF5D0B4B1EB13884BA66B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX51D8.tmp
- Size 284KB
- SHA256 124292ba305a2aa786d0f6a76c0552fea7c4147e576c0abf3eeac23184a84e68
- MD5 a3664b711abecea9f85e3c3715a2b42d
- SHA1 2553fc5db1ff410fbd9cb8c88daa2e4bbf3bcbb1
- SHA512 a531a4e89b80d219543f3b0de488106775412a73301cdd3c946c45a519ee59bf17f1770a67b199e21b5e0f6922ffdc22aaaaea4e406945647048956d5d87e5c3
- SSDEEP 6144:uFlKgzelZNQSBQGH/CSpWqTfoAXjiU4bz:JfBQGH6SfzoAX+U4
- TLSH T17C5402457D93D4B3D0414D3188E78BE18B7F6C137AA6E11BFB9D0B4B1EB13884BA6261
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX51D9.tmp
- Size 284KB
- SHA256 38e1390cc14c261f2b77b917c49283e24f3fd089aaba6104bdc84db5a871098d
- MD5 f6d5d0a8a0a88951cde9b5f1138503e6
- SHA1 0b041aa4b8a144945b7a45eecfee43fea37752b9
- SHA512 d1287d566e22b914965137bb1bf5db5ed1a8cf08e841fc9d26a178af512811888c18368b54dc8ffc7cb884dba8b24f85c84c148f7d41cf5602874e19e7d37232
- SSDEEP 6144:GFlKgzelZNQSBQGH/CSpWqTZoAXjiU4bz:hfBQGH6Sf9oAX+U4
- TLSH T1CA5402457DA3C4B3D0414D3188E68BE19B7F6C137AA6E11BFB9D0B4B1EB13844B6A361
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\RCX50E7.tmp
- Size 284KB
- SHA256 aa2241ecfb4c363500bb6c584488043d93ce4f33f6d84bff8105cacde0b0a3c5
- MD5 735e799bcf3c530a54f41fa7591e0bfa
- SHA1 c948859c4798b7cc43e8f85c7788839c8d1c31ae
- SHA512 b28d05492a6bb6afa7011551b52400445311e10b8ad2d7eef580350b377987b9c79932f0fe6327f23eab877638f490f7af5a2cdd348bbc32ca7b22ed9827fbe4
- SSDEEP 6144:qFlKgzelZNQSBQGH/CSpWqTAoAXjiU4bz:tfBQGH6Sf0oAX+U4
- TLSH T17C54F1457D93C4B3D0414D31C9E68BE14B7E6C037AA6E11BFB5D0B4B1EB13884BAA6B1
- MD5 SHA1 SHA512 SSDEEP TLSH