Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/11/2026, 15:43
Behavioral task
behavioral1
Sample
2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe
- Size 284KB
- Sample261102-s5we4sdt2p
- SHA256 cffd0bf002025ff40007c02dc9baf75b026bd758faa308b91d05cbc058d59949
- MD5 88b129a22478ed7c35118a52c29ba9f7
- SHA1 3514438fb717e65f1ebb1850f20466cd31c308ec
- SHA512 3d2e1147c03ac28caa6476e4c1a4a8209c81fdd889441c35a36f0409acc43d20c7c52e264e69b5f22639d312dee4d30e92e8ab4825e3e5fd17a158c4fb7a47a2
- SSDEEP 6144:5FlKgzelZNQSBQGH/CSpWqT1oAXjiU4bzV:OfBQGH6SfRoAX+U4l
- TLSH T1AF5402457DA3C4B3D0414D3188E68BE19B7F6C137AA6E11BFB9D0B4B1EB13844B6A361
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Cosmu payload 5 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000300000001b2d0-3.dat family_cosmu behavioral2/files/0x00060000000184bc-60.dat family_cosmu behavioral2/files/0x000400000001bb5f-87.dat family_cosmu behavioral2/files/0x000a00000001bb4d-185.dat family_cosmu behavioral2/files/0x000d00000001c4ec-189.dat family_cosmu - Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\M: 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\O: 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\D: 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\G: 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\I: 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\J: 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\K: 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\L: 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\N: 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\Application\chrome_proxy.cab 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.cab 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.cab 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX3EB.tmp 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX303.tmp 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\crashreporter.cab 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.cab 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7zFM.cab 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX167.tmp 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX28D.tmp 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.cab 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX379.tmp 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.cab 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCX464.tmp 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX257.tmp 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX28C.tmp 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.cab 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX3FE.tmp 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCX465.tmp 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7z.cab 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7z.exe 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX2AE.tmp 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.cab 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX3EC.tmp 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.cab 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX102.tmp 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.cab 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.cab 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\dotnet.cab 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX357.tmp 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ielowutil.cab 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\RCX420.tmp 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCX454.tmp 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX326.tmp 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome.cab 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX27A.tmp 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX2E3.tmp 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX431.tmp 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX103.tmp 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX27B.tmp 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX315.tmp 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ExtExport.cab 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iexplore.cab 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX442.tmp 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCXF0.tmp 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX268.tmp 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-01_88b129a22478ed7c35118a52c29ba9f7_elex_rhadamanthys_smoke-loader.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4384
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 327KB
- SHA256 750c0ae4368aab2215e6cd952dc8bd3bf7c774dba2b4a37f633050138a8289dc
- MD5 22e923c393d35e56fa5a138e6871b583
- SHA1 a57c35588640e2fc713aae49fb97a50d8a44033a
- SHA512 3d188f8ecf3cf236fa4f2642261c700f2ebc96987642b1940d88cd374675f34b075aa3567e914963cd6a4cac3731a2213651144116a0f0aadb809e077f0260f5
- SSDEEP 6144:qFlKgzelZNQSBQGH/CSpWqTyoAXjiU4bz:tfBQGH6SfeoAX+U4
- TLSH T15564F1457D93C4B3E0414D31C9E68AE14B7E6C037AA6E11BFF5D0B4B1EB13884BA66B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX37A.tmp
- Size 284KB
- SHA256 d34906d1e8fd472a739ab92e57e7067e13f0165833ca45814575ecc788a3069f
- MD5 a020dc5e2bb713569d16f533895039be
- SHA1 8aab46487c62d11f8d1351a66454f87407b9708f
- SHA512 838027c3e88f872be0b1a0ad638b202345c53d0313aee728987f81821f255881236c57485b5307bceb4f8052ea0ccf6b356fadfcda3f773cc75402f87a132d56
- SSDEEP 6144:qFlKgzelZNQSBQGH/CSpWqTfoAXjiU4bz:tfBQGH6SfzoAX+U4
- TLSH T10A5402457D93D4B3D0414D3188E78BE18B7F6C137AA6E11BFB9D0B4B1EB13884BA6261
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX38A.tmp
- Size 284KB
- SHA256 8089d2be11b4a71368f080cc0738f474449223b8489bfbb425484935b9e45158
- MD5 704193208573728dd443db2010dbf027
- SHA1 01b15cacfa26383eb3b9ebc914145b85a33f9fe8
- SHA512 e5caaecc967f9558e4eeed1e870b7e490da8c6c1059eef4a306fe20e8f0a57117d4744daff2cec79a281f5244e8e80d44bf3bca2343c45ed18145a2c5bddd093
- SSDEEP 6144:CFlKgzelZNQSBQGH/CSpWqTZoAXjiU4bz:FfBQGH6Sf9oAX+U4
- TLSH T1E95402457DA3C4B3D0414D3188E68BE19B7F6C137AA6E11BFB9D0B4B1EB13844B6A361
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\RCX279.tmp
- Size 284KB
- SHA256 c961b1f2c067198f92dc767f272f2ea99a48a45600ae80f4b88f0586c9907c29
- MD5 f516b7ba11be4a695842978a3a5b62f7
- SHA1 fc893d2d58d1771d02700fbd196db81c407fe4d6
- SHA512 512438633e59f9bd2bf584d8b7cd6603ee0ff46728da27b45f20e79a84f8a5e03236da430a1addbfa3eecf68e68e4a7c83a77ede1cc650d08dbe2c4f7ea64313
- SSDEEP 6144:GFlKgzelZNQSBQGH/CSpWqTAoAXjiU4bz:hfBQGH6Sf0oAX+U4
- TLSH T19654F1457D93C4B3D0414D31C9E68BE14B7E6C037AA6E11BFB5D0B4B1EB13884BAA6B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 284KB
- SHA256 7a11d92853baba434d7b68d1bfded949787c81a83969fc7767452afa5ac5eecc
- MD5 ebf1109619e03fffdbd5bb40e3552716
- SHA1 217359f5f732c41555ad1f164d68ba5405978e00
- SHA512 f0423fc30f8966e30395663bbafd9a2b3f7a3d01fb482838c2f806fe66e648a33dc29bf2342cb76c49fa069a09d37aa42c0e2ee7fbe2191d99be2bad5c2b854a
- SSDEEP 6144:KFlKgzelZNQSBQGH/CSpWqT1oAXjiU4bzl:NfBQGH6SfpoAX+U4V
- TLSH T1075402457D93C4B3D0414D3188E68BE19B7F6C137AA6E11BFB9D0B4B1EB13844BAA361
- MD5 SHA1 SHA512 SSDEEP TLSH