Analysis
- max time kernel
148s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/11/2026, 14:07
Behavioral task
behavioral1
Sample
2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe
- Size 1.4MB
- Sample261102-rey8mscx5p
- SHA256 def9ba6ff427e248b58ea755711708f4b738a1472bcc8c0af6d9699bcc9da318
- MD5 9895452421af8fa63ca299a64301bf82
- SHA1 d716e37f368289255b3661b9ad27d5945efe3036
- SHA512 6c855b3051ca0ffd2585b3898a3966a846ed241be2af3c4bde29216a191a6455e579f2cd79968ddad066565b80f008a4c74d137d5abe4365e9b67fb267cb0e86
- SSDEEP 24576:Vfa86SfLkQ5W9GIpThCTZ0og6f5MLb+VONw/haSqnFGUMhglHZaawTXaf:VfaygL9fpTgTZ0og6fWLb+VOa/hunKhY
- TLSH T19765CFC2F202D0A5DC1645308C27DFF81B16BE62AD1116177BD8BF5FAEB3382592259B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Cosmu payload 5 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x001000000001c515-3.dat family_cosmu behavioral2/files/0x000d00000001c521-86.dat family_cosmu behavioral2/files/0x000e00000001c523-120.dat family_cosmu behavioral2/files/0x001000000001c522-189.dat family_cosmu behavioral2/files/0x000300000001baf7-185.dat family_cosmu - Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\K: 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\M: 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\N: 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\I: 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\J: 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\L: 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\O: 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\D: 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\G: 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXA6FB.tmp 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.cab 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCXA4BB.tmp 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCXA4CD.tmp 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ielowutil.exe 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCXA866.tmp 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXA6E9.tmp 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCXA793.tmp 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.cab 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ExtExport.cab 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ieinstal.exe 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXA71E.tmp 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXA75F.tmp 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCXA455.tmp 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCXA50E.tmp 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXA6D6.tmp 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCXA467.tmp 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCXA4FE.tmp 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXA6D7.tmp 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXA74F.tmp 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.cab 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iediagcmd.cab 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCXA89B.tmp 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.cab 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\dotnet.cab 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCXA806.tmp 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCXA878.tmp 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.cab 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iexplore.exe 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7z.cab 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXA70C.tmp 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.cab 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXA6FC.tmp 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCXA7C6.tmp 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCXA88B.tmp 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCXA8CF.tmp 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXA6FA.tmp 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCXA7B5.tmp 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCXA88A.tmp 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.cab 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCXA89C.tmp 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.cab 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-01_9895452421af8fa63ca299a64301bf82_elex_rhadamanthys_smoke-loader.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2976
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 323KB
- SHA256 b2da2a5629713b8ef88ae806caa3e4b5003fe3f753a655dcdfd37f6b1d7d06d7
- MD5 e5143e1798c511e7177c55afd8751b20
- SHA1 6e33dca40a250fdd8ee5b20569cace3fa83a2a49
- SHA512 c3f5fc9f3b74b859dcfbdf99f5e8f5aa7a12170474f475a7e2a865f41773c1e471f0755956acdfaa53fdabba3ccd23b3615e1041bc41528d85274fcc66bb53c0
- SSDEEP 6144:qFlKgzelZNQSBQGH/CSpWqTyoAXjiU4bz:tfBQGH6SfeoAX+U4
- TLSH T13964F1457D93C4B3E0414D31C9E68AE14B7E6C037AA6E11BFF5D0B4B1EB13884BA66B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCXA807.tmp
- Size 284KB
- SHA256 d34906d1e8fd472a739ab92e57e7067e13f0165833ca45814575ecc788a3069f
- MD5 a020dc5e2bb713569d16f533895039be
- SHA1 8aab46487c62d11f8d1351a66454f87407b9708f
- SHA512 838027c3e88f872be0b1a0ad638b202345c53d0313aee728987f81821f255881236c57485b5307bceb4f8052ea0ccf6b356fadfcda3f773cc75402f87a132d56
- SSDEEP 6144:qFlKgzelZNQSBQGH/CSpWqTfoAXjiU4bz:tfBQGH6SfzoAX+U4
- TLSH T10A5402457D93D4B3D0414D3188E78BE18B7F6C137AA6E11BFB9D0B4B1EB13884BA6261
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCXA808.tmp
- Size 284KB
- SHA256 8089d2be11b4a71368f080cc0738f474449223b8489bfbb425484935b9e45158
- MD5 704193208573728dd443db2010dbf027
- SHA1 01b15cacfa26383eb3b9ebc914145b85a33f9fe8
- SHA512 e5caaecc967f9558e4eeed1e870b7e490da8c6c1059eef4a306fe20e8f0a57117d4744daff2cec79a281f5244e8e80d44bf3bca2343c45ed18145a2c5bddd093
- SSDEEP 6144:CFlKgzelZNQSBQGH/CSpWqTZoAXjiU4bz:FfBQGH6Sf9oAX+U4
- TLSH T1E95402457DA3C4B3D0414D3188E68BE19B7F6C137AA6E11BFB9D0B4B1EB13844B6A361
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\RCXA6D7.tmp
- Size 284KB
- SHA256 c961b1f2c067198f92dc767f272f2ea99a48a45600ae80f4b88f0586c9907c29
- MD5 f516b7ba11be4a695842978a3a5b62f7
- SHA1 fc893d2d58d1771d02700fbd196db81c407fe4d6
- SHA512 512438633e59f9bd2bf584d8b7cd6603ee0ff46728da27b45f20e79a84f8a5e03236da430a1addbfa3eecf68e68e4a7c83a77ede1cc650d08dbe2c4f7ea64313
- SSDEEP 6144:GFlKgzelZNQSBQGH/CSpWqTAoAXjiU4bz:hfBQGH6Sf0oAX+U4
- TLSH T19654F1457D93C4B3D0414D31C9E68BE14B7E6C037AA6E11BFB5D0B4B1EB13884BAA6B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome.exe
- Size 1.5MB
- SHA256 bf5b8d011bc130cc9b684fbd76b05a7cff8bfabeb6ad624ba90a786a6264dffb
- MD5 2628b7cbf364c79ec46f66ce472c1e15
- SHA1 954eb4481e1bd7dc5bf09e3bc5c1bb860c9b9f9e
- SHA512 9e24e53caf3708819475faa8d5cb625c23b9214d7067e9804a845a7511fc647a2aa4d3c4ef82f85712f7aea3394e34566927aee0242c17658956fda6a16aeab8
- SSDEEP 6144:JFlKgzelZNQSBQGH/CSpWqTxGYxlkBx3aoAXjiU4bz:+fBQGH6SfNGYUBUoAX+U4
- TLSH T160650141BE83DCB3D001053188E78BE1177E9D13A676D217FF9D1A0B2EB238556B7A62
- MD5 SHA1 SHA512 SSDEEP TLSH