Analysis
- max time kernel
148s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/11/2026, 08:53
Behavioral task
behavioral1
Sample
2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe
- Size 284KB
- Sample261102-ktfxaaef37
- SHA256 87fa8db84a2b4baf66573471798b602210b72dd1bc2b465646228d4a0cfdba8e
- MD5 c8e68980cc9893c941ec0b3ce68619e5
- SHA1 c3a96539541a54122e178127f9d9ecd8c8ff8ba6
- SHA512 d35a3891bddd2afbc16b229a8a5a205fa38e55c14e57029c3a2357b55c1c9ac33d740cbf4d482233f697ef38603d61a2c99dbecb45680de6382805ed9ab1d973
- SSDEEP 6144:5FlKgzelZNQSBQGH/CSpWqTYoAXjiU4bz1:OfBQGH6SfUoAX+U4F
- TLSH T1C95402457DA3C4B3D0414D3188E68BE19B7F6C137AA6E117FB9D0B4B1EB13844BAA361
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Cosmu payload 5 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000e00000001c4c8-3.dat family_cosmu behavioral2/files/0x000d00000001c4d0-60.dat family_cosmu behavioral2/files/0x000d00000001c4d3-87.dat family_cosmu behavioral2/files/0x000300000001baf7-185.dat family_cosmu behavioral2/files/0x000400000001baf8-189.dat family_cosmu - Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\K: 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\L: 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\M: 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\D: 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\G: 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\H: 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\J: 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\N: 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\O: 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ielowutil.cab 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\readme.1xt 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7z.cab 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX459B.tmp 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.cab 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX4722.tmp 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX45D1.tmp 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX467B.tmp 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ieinstal.cab 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iexplore.cab 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX45AC.tmp 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX4744.tmp 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX4615.tmp 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.cab 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.cab 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ExtExport.exe 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX45E2.tmp 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX4603.tmp 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX4626.tmp 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX4417.tmp 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.cab 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome.cab 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.cab 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCX4789.tmp 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.cab 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX46FF.tmp 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX4755.tmp 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX447B.tmp 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.cab 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\crashreporter.cab 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7zFM.cab 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX469C.tmp 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX469D.tmp 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iexplore.exe 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX4405.tmp 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX45BF.tmp 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX4658.tmp 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ieinstal.exe 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ielowutil.exe 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCX4788.tmp 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX4469.tmp 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX459C.tmp 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX4637.tmp 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX46DF.tmp 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-01_c8e68980cc9893c941ec0b3ce68619e5_elex_rhadamanthys_smoke-loader.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1744
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 327KB
- SHA256 60ac1ee9b267690129082bc9baa4f9be0bb3f17129b52f3a5d266210c00d2dfa
- MD5 b0024006d4a5e1eddd70fbad911067bb
- SHA1 ded59ef4c48e2599c912aca9a86e98bf39d52552
- SHA512 6ae7ebf860c62c6364ec9265f7deea98db8c2e97fa2a8fe2521608e9255dc82d75cd08de0dc0bb1149fc243a109b7d5e80cfbd7148255917833fd78794f57495
- SSDEEP 6144:qFlKgzelZNQSBQGH/CSpWqTyoAXjiU4bz:tfBQGH6SfeoAX+U4
- TLSH T11364F1457D93C4B3E0414D31C9E68AE14B7E6C037AA6E11BFF5D0B4B1EB13884BA66B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX469D.tmp
- Size 284KB
- SHA256 d34906d1e8fd472a739ab92e57e7067e13f0165833ca45814575ecc788a3069f
- MD5 a020dc5e2bb713569d16f533895039be
- SHA1 8aab46487c62d11f8d1351a66454f87407b9708f
- SHA512 838027c3e88f872be0b1a0ad638b202345c53d0313aee728987f81821f255881236c57485b5307bceb4f8052ea0ccf6b356fadfcda3f773cc75402f87a132d56
- SSDEEP 6144:qFlKgzelZNQSBQGH/CSpWqTfoAXjiU4bz:tfBQGH6SfzoAX+U4
- TLSH T10A5402457D93D4B3D0414D3188E78BE18B7F6C137AA6E11BFB9D0B4B1EB13884BA6261
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX46AE.tmp
- Size 284KB
- SHA256 8089d2be11b4a71368f080cc0738f474449223b8489bfbb425484935b9e45158
- MD5 704193208573728dd443db2010dbf027
- SHA1 01b15cacfa26383eb3b9ebc914145b85a33f9fe8
- SHA512 e5caaecc967f9558e4eeed1e870b7e490da8c6c1059eef4a306fe20e8f0a57117d4744daff2cec79a281f5244e8e80d44bf3bca2343c45ed18145a2c5bddd093
- SSDEEP 6144:CFlKgzelZNQSBQGH/CSpWqTZoAXjiU4bz:FfBQGH6Sf9oAX+U4
- TLSH T1E95402457DA3C4B3D0414D3188E68BE19B7F6C137AA6E11BFB9D0B4B1EB13844B6A361
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\RCX45AC.tmp
- Size 284KB
- SHA256 c961b1f2c067198f92dc767f272f2ea99a48a45600ae80f4b88f0586c9907c29
- MD5 f516b7ba11be4a695842978a3a5b62f7
- SHA1 fc893d2d58d1771d02700fbd196db81c407fe4d6
- SHA512 512438633e59f9bd2bf584d8b7cd6603ee0ff46728da27b45f20e79a84f8a5e03236da430a1addbfa3eecf68e68e4a7c83a77ede1cc650d08dbe2c4f7ea64313
- SSDEEP 6144:GFlKgzelZNQSBQGH/CSpWqTAoAXjiU4bz:hfBQGH6Sf0oAX+U4
- TLSH T19654F1457D93C4B3D0414D31C9E68BE14B7E6C037AA6E11BFB5D0B4B1EB13884BAA6B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 284KB
- SHA256 6b1152e5e715281dd190e0cf6d832cf4001e4006fe543c638edf8539068e1eee
- MD5 7edebe28c99ce7924af560f4b6a43537
- SHA1 11a5f6ba9364e72fe22b72b0e9896fce1e1dfe6f
- SHA512 64ab8f695590b1fba22f64c5ea8ae72facb4c351c36efecd0ab75644e31e8ce25867a3af5a1f4042e822b575ea61ae89744b040c8cb872dc22e97f24e2af9b57
- SSDEEP 6144:KFlKgzelZNQSBQGH/CSpWqT1oAXjiU4bzl:NfBQGH6SfpoAX+U4V
- TLSH T1125402457D93C4B3D0414D3188E68BE19B7F6C137AA6E11BFB9D0B4B1EB13844BAA361
- MD5 SHA1 SHA512 SSDEEP TLSH