cosmu | 7cc8940668c4fd8a83857d1c1a836208502161bf20a7e3bc0ecd8a70e5763854

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/10/2026, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe
Size 1.4MB
Sample261029-sdapbscw9w
SHA256 7cc8940668c4fd8a83857d1c1a836208502161bf20a7e3bc0ecd8a70e5763854
MD5 3a98ea60f4d815a713e4a85cc5d6e411
SHA1 51fa4463cf6fccdac20295dfb2259bf273da0417
SHA512 aaaac3d0484ec524a4495fb18794b064bec6d2f3eb75de91641ddcaef6bbf31f1900ce03e175408a14d4c0d41ab2a47dedd950d373516d50789b179b6fb57bb5
SSDEEP 24576:Ofa86SfLkQ5W9GIpThCTZ0og6f5MLb+VONw/haSqnFGUMhglHZaawTXax:OfaygL9fpTgTZ0og6fWLb+VOa/hunKh8
TLSH
T10765CFC2F202D0A5DC1645308C27DFF81B16BE62AD1116177BD8BF5FAEB3382592259B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery cosmu worm

Malware Config

Signatures

Family: Cosmu
Cosmu is a Windows worm written in C++.
worm cosmu

Detects Cosmu payload 4 IoCs

Cosmu is a worm written in C++.

resource	yara_rule
behavioral2/files/0x000300000001b2cd-3.dat	family_cosmu
behavioral2/files/0x000400000001bb3f-86.dat	family_cosmu
behavioral2/files/0x000300000001bb41-184.dat	family_cosmu
behavioral2/files/0x000d00000001c4cb-188.dat	family_cosmu

Enumerates connected drives 3 TTPs 10 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\K:	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\L:	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\M:	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\N:	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\O:	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\G:	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\H:	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\I:	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\J:	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.cab	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Internet Explorer\ieinstal.cab	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.cab	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Java\jre-1.8\bin\jabswitch.cab	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\RCXAD63.tmp	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCXABE9.tmp	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.cab	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCXACFC.tmp	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\RCXAA06.tmp	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\RCXAA37.tmp	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.cab	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.cab	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\RCXA9F3.tmp	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Internet Explorer\ielowutil.exe	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.cab	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\RCXA9E2.tmp	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\RCXAA49.tmp	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.cab	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.exe	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCXABB5.tmp	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.cab	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\7-Zip\7z.exe	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCXABB6.tmp	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCXABEA.tmp	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCXAC1B.tmp	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCXAB2D.tmp	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCXAC8C.tmp	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Mozilla Firefox\default-browser-agent.cab	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\RCXAD85.tmp	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.cab	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.cab	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\readme.1xt	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCXAB94.tmp	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Internet Explorer\iediagcmd.cab	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Internet Explorer\ieinstal.exe	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Internet Explorer\ielowutil.cab	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\dotnet\RCXAA5A.tmp	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCXAB2A.tmp	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Internet Explorer\iexplore.exe	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\RCXAD1E.tmp	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Java\jre-1.8\bin\java-rmi.cab	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7z.cab	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\7-Zip\7zFM.cab	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-29_3a98ea60f4d815a713e4a85cc5d6e411_elex_rhadamanthys_smoke-loader.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5080

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 336KB
SHA256 1c4664f0e67ddb068ede3ac2f6e5588b70a3ff9a1865081ba731ce9f737771f9
MD5 5bcf6fc5be69ac89a082381fc1719b1c
SHA1 f27d086d9ad0d48457e016a1a70cf624598e7a19
SHA512 fdaf54e8e7ed2509a726fad2f430266dfcf47bae5152a9a64847bb0e378f42ab75ab3ac1dc04f7b155d14282b758f748ce72dbda2d8df3dc0b399f6d78bc95cf
SSDEEP 6144:OFlKgzelZNQSBQGH/CSpWqTyoAXjiU4bz:pfBQGH6SfeoAX+U4
TLSH
T1DF74F1457D93C4B3E0414D31C9E68AE14B7E6C037AA6E11BFF5D0B4B1EB13884BA66B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXAC4C.tmp

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCXAC4C.tmp
Size 284KB
SHA256 d6af5fe6dd530ebf87862be7d7a57190b291cb357110d91b0067c407ad0821ef
MD5 bef208984483b8c5d4ce53e7d174ca06
SHA1 609410599d2a18ed4a130b0e7522fbbc78c2cde5
SHA512 b8c870716f7323adb1c9a6876e3959a84e85bcfc39b2995c4a455e5b6238eeeb6c475fa91eaa311a8e5c0da6799cc534dce5e1a71014ba9eec9483797c7e7e91
SSDEEP 6144:uFlKgzelZNQSBQGH/CSpWqTfoAXjiU4bz:JfBQGH6SfzoAX+U4
TLSH
T1A154F2457D93D4B3D0414D3188E78BE18B7F6C137AA6E11BFB9D0B4B1EB13884BA6261
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXAC8C.tmp

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCXAC8C.tmp
Size 284KB
SHA256 fd715ffb14f65c3abbc3ea7c21a7cebc764bd9146c08309f523e6b013a94718e
MD5 6560075cf78ec8f2dce1bc8ac3aee92b
SHA1 1eae628f8615d671b20636d5cf56367e1aa028aa
SHA512 41f8c657b1a9d897172edbca65ada99f2b823874d6608696bf8cefc1c71d15c07809fb9b58d7b1844dee13f15373c7129f57df373715c346d4014da4e82daaca
SSDEEP 6144:GFlKgzelZNQSBQGH/CSpWqTZoAXjiU4bz:hfBQGH6Sf9oAX+U4
TLSH
T11C5402457DA3C4B3D0414D3188E68BE19B7F6C137AA6E11BFB9D0B4B1EB13844B6A361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXAB2D.tmp

Path C:\Program Files\Google\Chrome\Application\RCXAB2D.tmp
Size 284KB
SHA256 1c55ffdc10badee287aefbcdf7b4a1b5f41e06b6eab5c295d2c2e42c06ba0813
MD5 62d028fc024dc24ea40d5c8696790e06
SHA1 15d24d80a2cb85684214f88493a7a1d14783095b
SHA512 cc6986b3724a43b7e9d0dbe4b6f4edc0b8e1d68e84f78d2c93545ffeae55d318992b53f590ab2348eadff81510ee578fddd4c8eff9e45809e2b9dc3679c4b9e2
SSDEEP 6144:qFlKgzelZNQSBQGH/CSpWqTAoAXjiU4bz:tfBQGH6Sf0oAX+U4
TLSH
T16654F1457D93C4B3D0414D31C9E68BE14B7E6C037AA6E11BFB5D0B4B1EB13884BAA6B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads