Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/11/2026, 21:16
Behavioral task
behavioral1
Sample
2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe
- Size 284KB
- Sample261102-z4ejjadt2x
- SHA256 652efc718b5bf3298a4ef46d5311c0947251d4dff9f2d0e44ca9f6131253130b
- MD5 d84e344d617fdb13a81613865100f361
- SHA1 62db117ab88132bbbf89d47f2ca148863b399466
- SHA512 35de12f80c2df25cde5c9ab9687f1cc26cb91b8b0efd3b935699d4e2635d86d68d142e02ce72c39c43887559ff3f7622fea083a15f98ab28f4c8f4c0619fa59e
- SSDEEP 6144:xFlKgzelZNQSBQGH/CSpWqTOoAXjiU4bzt:mfBQGH6SfaoAX+U4d
- TLSH T1925402457D93C4B3D0414D3188E68BE18B7F6C137AA6E11BFB9D0B4B1EB13884BA6661
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000f00000001c60c-3.dat family_cosmu behavioral2/files/0x000c00000001c61a-86.dat family_cosmu behavioral2/files/0x000300000001bb46-184.dat family_cosmu behavioral2/files/0x000c00000001c620-188.dat family_cosmu - Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\G: 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\I: 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\K: 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\L: 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\D: 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\H: 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\J: 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\M: 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\N: 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX24E9.tmp 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX250A.tmp 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.cab 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7z.cab 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX2441.tmp 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX2582.tmp 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX25C5.tmp 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX241A.tmp 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX242C.tmp 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iexplore.exe 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\RCX25A2.tmp 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCX2349.tmp 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX24E8.tmp 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX251C.tmp 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.cab 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCX25D6.tmp 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCX234A.tmp 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX25B3.tmp 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX24FA.tmp 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX2580.tmp 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7zFM.cab 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCX236B.tmp 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.cab 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX2487.tmp 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.cab 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ielowutil.cab 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.cab 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.cab 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.cab 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.cab 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX2464.tmp 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX2315.tmp 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCX236A.tmp 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX256F.tmp 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCX25D7.tmp 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\readme.1xt 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCX2348.tmp 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome.cab 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.cab 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.cab 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7zFM.cab 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-02_d84e344d617fdb13a81613865100f361_elex_rhadamanthys_smoke-loader.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4644
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 326KB
- SHA256 af2493df448379def9a0c4ff6ba4d084f20bf1a80fcc521c51054b932638b38b
- MD5 da46c1b63bcbde43d55c68923cc77af4
- SHA1 58f744a04a939b155f3fabe33865353e86ea2ccf
- SHA512 e58f2cd802b7868f0a999d297ef5b5e576d217e47ae5ae4f0e784b6c4092036ab24cd310e2d32a7b9bdc70985cf7be192bd96b6719f48ee9efb489d27558fe13
- SSDEEP 6144:sFlKgzelZNQSBQGH/CSpWqTyoAXjiU4bz:rfBQGH6SfeoAX+U4
- TLSH T10E64F1457D93C4B3E0414D31C9E68AE14B7E6C037AA6E11BFF5D0B4B1EB13884BA66B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX251B.tmp
- Size 284KB
- SHA256 5d049311cbe83a6fa41fcf095c284755cdcdf0afa57ad4c06b08a94ad3811336
- MD5 316648859b18541c69450301203fd9fa
- SHA1 838572b40b953b0b071c3c453ba059ff5f8bd765
- SHA512 f5be4d768676ce3ff050fe6aa5b4ffcab7722648afdb1d2c56cde9b253f18ddde1a09657d56094dd5a2d87bcaae4b4251570b635306ec673f5a9980cc9453bbf
- SSDEEP 6144:EFlKgzelZNQSBQGH/CSpWqTfoAXjiU4bz:jfBQGH6SfzoAX+U4
- TLSH T1A05402457D93D4B3D0414D3188E78BE18B7F6C137AA6E11BFB9D0B4B1EB13884BA6261
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX251C.tmp
- Size 284KB
- SHA256 7f2de3d2ac4a5351d35e81828064e8c18c7110b459b7e18b7ea5d9bfa7a800a8
- MD5 cfe71da77a0db49f1dde981aa801395a
- SHA1 8aab7ca05ed7503ac167c873d6a61b948630ab64
- SHA512 fdcd5e8cad086759d95f85a43305ff993c9b8591e20bc9f59005cc9f8e8e7b48c41b221ee1890349ecc856a4486011c0175e5704d9cd07bb5ce9723c1edd0b05
- SSDEEP 6144:cFlKgzelZNQSBQGH/CSpWqTZoAXjiU4bz:7fBQGH6Sf9oAX+U4
- TLSH T1965402457DA3C4B3D0414D3188E68BE19B7F6C137AA6E11BFB9D0B4B1EB13844B6A361
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\RCX241B.tmp
- Size 284KB
- SHA256 165c9f430831ce9a82c051c1cdbc0cbe43452868e0828e13e2dc34b0cbb2f61f
- MD5 4649d05b5878c12764833198cef2faa6
- SHA1 c6827ab019783de14d93ebfc32836b895ba526c6
- SHA512 db613def4a5b3d74dbe77e22aea0184b6e978bd8a655ef92af522259321e73e0a0203e900b002f0cf32ce5b9890b85f8504596c2afdd5ed8e70c0bc92115f1d9
- SSDEEP 6144:YFlKgzelZNQSBQGH/CSpWqTAoAXjiU4bz:vfBQGH6Sf0oAX+U4
- TLSH T13854F1457D93C4B3D0414D31C9E68BE14B7E6C037AA6E11BFB5D0B4B1EB13884BAA6B1
- MD5 SHA1 SHA512 SSDEEP TLSH