Analysis
- max time kernel
148s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/11/2026, 16:52
Behavioral task
behavioral1
Sample
2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe
- Size 326KB
- Sample261101-vdq3escf74
- SHA256 8d2426fde000e6c17c0d851c442331312f8c4e0ab54f65d3e6e527b52436560b
- MD5 1802273a643609c0ca25b80ff18d5149
- SHA1 4737ea861194b9a4ea201930a6c205c1dd93e089
- SHA512 c7f1ebcae222f2354a6549b828de0ba27d2c4cfe2199e84ca1aca94c7511117deaf744fb9553465e7bafa6edb8a57ed61d077e60faeaff73577d8097137196de
- SSDEEP 6144:FFlKgzelZNQSBQGH/CSpWqTvoAXjiU4bz:CfBQGH6SfboAX+U4
- TLSH T1E56401817DA3D8B3D041493188A6CBA1973B6D13AA65D203FB9D0F4B2FB13D49B7A351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000e00000001c563-3.dat family_cosmu behavioral2/files/0x000d00000001c56e-86.dat family_cosmu behavioral2/files/0x000300000001bb7c-184.dat family_cosmu behavioral2/files/0x000e00000001c573-188.dat family_cosmu - Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\I: 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\K: 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\D: 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\H: 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\J: 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\L: 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\M: 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\N: 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\O: 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\readme.1xt 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX220C.tmp 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX24A4.tmp 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX2310.tmp 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX2493.tmp 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX24A5.tmp 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX21D9.tmp 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\dotnet.cab 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX2313.tmp 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ielowutil.exe 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ExtExport.exe 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.cab 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.cab 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.cab 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.cab 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCX25F6.tmp 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCX25F7.tmp 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX22FE.tmp 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX2324.tmp 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX235B.tmp 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ExtExport.cab 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.cab 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX24B6.tmp 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.cab 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCX2260.tmp 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX238C.tmp 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX23AF.tmp 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.cab 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7z.cab 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX21D8.tmp 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX2327.tmp 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX23AE.tmp 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX24F8.tmp 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX21DB.tmp 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX2338.tmp 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.cab 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iediagcmd.cab 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX2481.tmp 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCX25D6.tmp 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\dotnet.cab 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX2422.tmp 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX21DA.tmp 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX2312.tmp 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX23F0.tmp 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.cab 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-01_1802273a643609c0ca25b80ff18d5149_elex_rhadamanthys_smoke-loader.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4608
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 324KB
- SHA256 2b4b8741b47ed0401a2af88fa6e9ef694fcd5fc9735950dc04378c3fb46823b6
- MD5 236db0feffe1a5dd5b6bcecbd7701739
- SHA1 107c52c81d06be662ce991ba4828ecd16818c3c1
- SHA512 030ff1ef6b54dcce39e86a26217bc847d68ec3ebc6c03837f88f48e7cced2ae191f9e849dc7ce976de08c192d4e3cbecb840c824908619aaa026830759eb30a2
- SSDEEP 6144:VFlKgzelZNQSBQGH/CSpWqTvoAXjiU4bz:yfBQGH6SfboAX+U4
- TLSH T1936401817DA3D8B3D041493188A6CBA1973B6D13AA65D203FB9D0F4B2FB13D49B7A351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX2421.tmp
- Size 288KB
- SHA256 385cafdcafae3a22aa32e89c335a14373ee979a2492c9182455e506b1db1d54a
- MD5 53960729f9ffa1dc63460e005f805990
- SHA1 e9b72f5629d62d1099fb7b94351778131ba5fa34
- SHA512 8e1cc7b30279efd922df064215ac6eb53ba2bc0046f6679a5f8e7e67a67b435163a5dd77d8b478db3175922714d0bd51528023c5053bc66bcec9f2a18ba6acc8
- SSDEEP 6144:VFlKgzelZNQSBQGH/CSpWqTjoAXjiU4bz:yfBQGH6Sf3oAX+U4
- TLSH T17B5401817DA2D8B3C4414A328CA78FA197376D139A65D203FBAD1F4B2F713D49B7A205
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX2422.tmp
- Size 288KB
- SHA256 8707ea6667e90dd5326d807794bbefc05ad3d29a2853440f38f8259d75a02da8
- MD5 a013ecaf4b9e725d5c121a536ce0d3fd
- SHA1 721554bc953b183ab8bfdde04bfee0174b7a2068
- SHA512 7afddf9acba88c64747990806a7024e23016d1a2fd0ec1743d9b1a9c475cea18db79f3957b19e4a2115b8e2692fdada2b495bb24b0908507b058442bb8e2b7f3
- SSDEEP 6144:dFlKgzelZNQSBQGH/CSpWqTSoAXjiU4bz:6fBQGH6Sf+oAX+U4
- TLSH T19F5401917EA2D8B3C0419A315CA68BA197377D139A65D203B7AD1F4B2F713D09B7A302
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\RCX2311.tmp
- Size 288KB
- SHA256 3b80a68d8daaf82c515b5ddc45978996bb2f082805aba93ef93134f929c60b48
- MD5 bbe7cdb19a933b699f6fcefe117b91d9
- SHA1 9ca371fc8fe08646f6b4fca6e51ca687b2921993
- SHA512 9459939923ae9a75cc7a9c2ea2cedd4a805e9eaac3bfc2b5e7b6566037a3ea310ba3e58ebf0006f8daf8ce1d60433d6ad94403a1229147789efc9ecf205fd3d3
- SSDEEP 6144:JFlKgzelZNQSBQGH/CSpWqTYoAXjiU4bz:+fBQGH6Sf8oAX+U4
- TLSH T12E5401917DA2D8B3D041493188A68FA1973B6D13AA65D203FB9D0F4B2FB13D49B7B241
- MD5 SHA1 SHA512 SSDEEP TLSH