Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/11/2026, 02:48
Behavioral task
behavioral1
Sample
2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe
- Size 284KB
- Sample261105-dahs7swzbv
- SHA256 6196c9b05b3c24e384eb5efd2dc0e5006c08b266a4caf532663c98ed98eb3552
- MD5 2b4f829a687ac5e3f3e8af1f8eecfbb8
- SHA1 b2b6bcf84bbfd26394eb5617c644cfc10722649c
- SHA512 d3508c53c3b2661234165e0d739d4e5ff31b2b071ee47ce259f1af5279702299325118a9072d8eae104043f5907f71b171f5c3e2c8d2cadd544e11b77f444628
- SSDEEP 6144:2FlKgzelZNQSBQGH/CSpWqT6oAXjiU4bzF:xfBQGH6SfOoAX+U41
- TLSH T1105402457D93C4B3D0414D3188E68BE19B7F6C137AA6E11BFB9D0B4B1EB13844BAA261
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000c00000001c5d7-4.dat family_cosmu behavioral2/files/0x000400000001bb66-87.dat family_cosmu behavioral2/files/0x000500000001bb57-173.dat family_cosmu behavioral2/files/0x0004000000019b65-222.dat family_cosmu - Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\I: 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\J: 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\K: 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\M: 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\N: 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\L: 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\O: 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\D: 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\G: 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe - Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Control Panel\Desktop\Wallpaper = "C:\\windows\\WallPapers.jpg" 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX4B12.tmp 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ExtExport.exe 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCX4BDD.tmp 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX4A04.tmp 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ielowutil.exe 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX485B.tmp 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCX4910.tmp 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.cab 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iediagcmd.cab 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.cab 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.cab 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX4A06.tmp 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7zFM.cab 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX488B.tmp 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\dotnet.cab 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.cab 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\dotnet.cab 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCX490F.tmp 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX4A6F.tmp 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iexplore.exe 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.cab 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX4B88.tmp 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.cab 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX4B13.tmp 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX4BBB.tmp 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.cab 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX489D.tmp 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX49E0.tmp 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX49F3.tmp 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.cab 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.cab 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX4AB0.tmp 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX4AC2.tmp 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.cab 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX4A16.tmp 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX4A6E.tmp 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ielowutil.cab 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7z.cab 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7z.exe 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX4A4C.tmp 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX4B65.tmp 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX4B77.tmp 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCX4952.tmp 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\windows\readme.1xt 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe File created C:\windows\WallPapers.jpg 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Desktop\General 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe Set value (str) \REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Desktop\General\WallpaperSource = "C:\\windows\\WallPapers.jpg" 2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-05_2b4f829a687ac5e3f3e8af1f8eecfbb8_elex_rhadamanthys_smoke-loader.exe"1⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:4680
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 333KB
- SHA256 8057eb80c2fc856c2aa9b2631122109c21d3904784a1ea542813e598227e6893
- MD5 d5eee12060166ceb60a9c8d77f29320e
- SHA1 1a6f1100d41fd048397bc50201d513200b31642d
- SHA512 336604cd3e3f9a1a99a8108d2f685e7fbcf479e8e9e13aad2595dc37b362d71051094c525631ac81e27f3978907edda662bcd7373c9c7d524556ef077b1b7385
- SSDEEP 6144:TFlKgzelZNQSBQGH/CSpWqTyoAXjiU4bz:8fBQGH6SfeoAX+U4
- TLSH T1E874F1457D93C4B3E0414D31C9E68AE14B7E6C037AA6E11BFF5D0B4B1EB13884BA66B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 1.5MB
- SHA256 58013b705586373430044745d452ddc17eed81b5568e5735e8984ac36b103021
- MD5 6e603a68890dcf37ff357aca593a992a
- SHA1 95fce8909537f801208927f8d51d3d77984a14b3
- SHA512 7cd71edfb2c42b4f229b16320677753137f77f70111dcca57b87c1759889ebf430d13699abb162e7cb0c7d377002b3cec3de712d25b9fea367a1e86f126ecb20
- SSDEEP 6144:DFlKgzelZNQSBQGH/CSpWqTfoAXjiU4bz:MfBQGH6SfzoAX+U4
- TLSH T1E77502457D93D4B3D0414D3188E78BE18B7F6C137AA6E11BFB9D0B4B1EB13884BA6261
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\RCX49F2.tmp
- Size 284KB
- SHA256 424287e77784c06138b7a9b01610521f24c9c35580c91bad209ae1a916c2cc28
- MD5 5f44bb6aa53df53df20adba164074ef9
- SHA1 3670f20e801e79451af49cdb2bdb9d18dbef9c71
- SHA512 879e613b12b2eb29def886d0f0a876b36c30e91460e241170e76c3dd19324adae8b4c0a109aa7ecdc639c4d4ed1920e0e29ca3970b78532fae79b24595456aeb
- SSDEEP 6144:vFlKgzelZNQSBQGH/CSpWqTAoAXjiU4bz:AfBQGH6Sf0oAX+U4
- TLSH T15E54F1457D93C4B3D0414D31C9E68BE14B7E6C037AA6E11BFB5D0B4B1EB13884BAA6B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\jabswitch.exe
- Size 284KB
- SHA256 273e2577f32a5dba3138b7b075bee64da10a91ec25b844a8c320a94421f9c8ef
- MD5 63bf534410af2ed78f584eee3c5d47fd
- SHA1 7a9e77a2ce42e5e052fe8efd2b2feffebc3531ee
- SHA512 d7addca58e0d9091f68a96af61059c53bdd6fb996b547a5e3ddf80377065d41e9e287b0603af740e43878ed4b4f6323ff301311af17cae9cc2b18524cd9d2014
- SSDEEP 6144:DFlKgzelZNQSBQGH/CSpWqTloAXjiU4bzt:MfBQGH6Sf5oAX+U4d
- TLSH T10A5402457D93C4B3D0414D3188E68BE19B7F6C137AA6E11BFB9D0B4B1EB13844BAA361
- MD5 SHA1 SHA512 SSDEEP TLSH