Analysis
- max time kernel
148s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/11/2026, 14:01
Behavioral task
behavioral1
Sample
2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe
- Size 284KB
- Sample261104-rblhdadf73
- SHA256 462f80e3890c34b6e8a7a63f53a556cdc814b22ab711ed2ba2deae698e229d81
- MD5 8f8060b1ec2736b38435c51a2825be1c
- SHA1 16daa6628b25fa498d4f4c6e7fab423e1ca9daec
- SHA512 8e93e54ddf7fb0e4b0e79cdfa1175384e0c92b4103e414dc29c3cd9de1884408af6f1367928ecba630855d64a5bb5a1b75912f068db6a3bf771d09c134bec408
- SSDEEP 6144:IFlKgzelZNQSBQGH/CSpWqT3oAXjiU4bzF:/fBQGH6SfzoAX+U41
- TLSH T1995402457D93C4B3D0414D3188E68BE19B7F6C137AA6E11BFB9D0B4B1EB13844BAA361
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Cosmu payload 6 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000d00000001c563-3.dat family_cosmu behavioral2/files/0x000300000001baf5-80.dat family_cosmu behavioral2/files/0x000d00000001c56c-85.dat family_cosmu behavioral2/files/0x000c00000001c56d-92.dat family_cosmu behavioral2/files/0x000300000001baf7-186.dat family_cosmu behavioral2/files/0x000c00000001c573-190.dat family_cosmu - Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\G: 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\H: 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\I: 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\K: 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\L: 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\N: 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\J: 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\M: 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\O: 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\7zFM.exe 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX8AE1.tmp 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.cab 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX88F5.tmp 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCX8916.tmp 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX8AE2.tmp 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX8AE3.tmp 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.cab 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX8B57.tmp 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iexplore.exe 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\dotnet.cab 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX8A7C.tmp 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.cab 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.cab 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCX8C13.tmp 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7z.cab 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX88E3.tmp 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX8A36.tmp 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX8BFE.tmp 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.cab 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX88D3.tmp 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.cab 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX8A47.tmp 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX8A5A.tmp 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX8A8D.tmp 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX8B04.tmp 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX8B97.tmp 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\readme.1xt 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX88D2.tmp 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCX8959.tmp 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ExtExport.cab 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX8B98.tmp 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX8BAA.tmp 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome.cab 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX8A05.tmp 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX8AAF.tmp 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.cab 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.cab 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX8B36.tmp 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.cab 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX8AD0.tmp 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.cab 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX88AE.tmp 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX88F6.tmp 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\crashreporter.cab 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX88F4.tmp 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-03_8f8060b1ec2736b38435c51a2825be1c_elex_rhadamanthys_smoke-loader.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1700
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 329KB
- SHA256 0dc8edebb7c0d6a7aeb709d120881c2d6e10e61cd203e50bbf44d10b362f2faa
- MD5 c2a7de4c5408625fd444b09723133f83
- SHA1 22e685661babd8c58752b766a153bf0c3f247461
- SHA512 3e9971208dafb4866d9a8b1b198094021f29eb73b36c6cb5505fd3455e2f009bc62d89202b75aece3b81a8a1f9808924d11b650a49a4dc0cf63405f15a7fecba
- SSDEEP 6144:hFlKgzelZNQSBQGH/CSpWqTyoAXjiU4bz:2fBQGH6SfeoAX+U4
- TLSH T19274F1457D93C4B3E0414D31C9E68AE14B7E6C037AA6E11BFF5D0B4B1EB13884BA66B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX8B57.tmp
- Size 284KB
- SHA256 4052de01a254170001a8dec4dc8066d0d610f4a526ba4a2ac754871644ba4808
- MD5 7f172be8a08b5568a84ae250034905fe
- SHA1 7abb38bbf191776f8517ba66263cce7e1c49e5fe
- SHA512 75bf567910c60d9f5f0c174c3c123937982f2d16c155a794924dafb00974b23118fca3264eb70b2fd50c0bf8382308ad7af1dcd15a89f85cbc75a401b6a4c773
- SSDEEP 6144:5FlKgzelZNQSBQGH/CSpWqTfoAXjiU4bz:OfBQGH6SfzoAX+U4
- TLSH T1205402457D93D4B3D0414D3188E78BE18B7F6C137AA6E11BFB9D0B4B1EB13884BA6261
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX8B58.tmp
- Size 284KB
- SHA256 c740c8451a0e0eeb3ad29f1a9994c02a527edc0debf868f12fa934fd9fb827b2
- MD5 0b22f65e164bebe09e886381d0f55dac
- SHA1 54ef887bd9662a1ca22d4253559cde29a3cb2988
- SHA512 f997606373d7c88da73cb58d079c277d58a51f67973298b2f70221b693083bbe535ebd6a9db14dbcbb73ba2da48bd0d3ed3c3e9f37bb417278cc551f98c001cf
- SSDEEP 6144:5FlKgzelZNQSBQGH/CSpWqTZoAXjiU4bz:OfBQGH6Sf9oAX+U4
- TLSH T1685402457DA3C4B3D0414D3188E68BE19B7F6C137AA6E11BFB9D0B4B1EB13844B6A361
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\RCX8A48.tmp
- Size 336KB
- SHA256 a8d105987582b0d8cc241d006bca888f2492555a1507f6d928ae63def4ab3de8
- MD5 d6fb8c6227b7c5476df39afde19bc015
- SHA1 21b21b4f84b18e325c91ef4fdc42000e21e5f21c
- SHA512 7f596349326fa17afb0926c7903a6bf9f66caa5c13ca8791bdf282a66ea007ddfb24ba946b1ffd252cb5541a297aeda15f581ea887740b8514ff3a96fda8da41
- SSDEEP 6144:cFlKgzelZNQSBQGH/CSpWqTItnRPF9cCGrJoAXjiU4bz:7fBQGH6SfknRNhWoAX+U4
- TLSH T10D74F1527E93D4B3D040493198A78BC2873B6C57AA66E103FFE93E472FB13905A73652
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome.exe
- Size 336KB
- SHA256 772d3b5bd654029eaf8bc00dbb298798bfe096c946f0e6715ff51dc4b149710d
- MD5 1abd3ca7cb689480b2e5e02ab533d159
- SHA1 60d9ba440d1858a91b004e3ffde9d7a8a954daf6
- SHA512 6ae9cf7ca19358bb49faf9b233da5777c750ae493799580acc9ed3f870618e1c8b217445931764ef17ae3f3dadfa18ef668ea2b1298b144d4cec1660a685252d
- SSDEEP 6144:YFlKgzelZNQSBQGH/CSpWqT9tnRPF9cCGrWoAXjiU4bz:vfBQGH6Sf7nRNhhoAX+U4
- TLSH T15374F1567E93D4B3D040493098A78BC2873F6C47AA66E113FFA93E472FB13905A73652
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome.exe
- Size 336KB
- SHA256 77a854325720989b6664fd658134118ff500062a78e459188f85b674fe6bed13
- MD5 fab7f784652310ec5c4690eaf7103606
- SHA1 61051fe66def9114b947c80893a64138e5a1ed96
- SHA512 cccd6e63e6a80bd09af682daa588ad81604b4395bbf63cdf781d35fcb69e068c2223b4c6a0c5bd1d889de8ee32ab398cf886358de1c2bf7b1804749e9005e783
- SSDEEP 6144:kFlKgzelZNQSBQGH/CSpWqT6tnRPF9cCGrYoAXjiU4bz:DfBQGH6SfqnRNh/oAX+U4
- TLSH T19574F1567E93D4B3D040493098A78BC2873B6C57AA66E103FFE93E472FB13905A73652
- MD5 SHA1 SHA512 SSDEEP TLSH