Analysis
- max time kernel
148s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/11/2026, 11:16
Behavioral task
behavioral1
Sample
2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe
- Size 349KB
- Sample261106-ndbjeact4j
- SHA256 82c09f38bb2ce910a5eec0b2435ededf50a491ca7c77f4a3228187032ba0f290
- MD5 ba89520c9159feaf0455f2b6f529262f
- SHA1 50d57df36243d650aeecf26c425916692e67eb10
- SHA512 f9a809b9a18db429445677ea34513c0d6a972de18aef75422970e862069e56bcd1d77fec7d6df36dbb4ae9d0093256da5e7885681a5b3df2877892b8d5d74e9d
- SSDEEP 6144:jFlKgzelZNQSBQGH/CSpWqT9w7oAXjiU4bz:sfBQGH6Sf27oAX+U4
- TLSH T12E74E0403A9ECBB2D3C249318C6EFAA157767C2F9B65D133F7983B0F1E712845A66201
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Cosmu payload 5 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000f00000001c49d-3.dat family_cosmu behavioral2/files/0x000d00000001c4a9-86.dat family_cosmu behavioral2/files/0x000d00000001c4ad-116.dat family_cosmu behavioral2/files/0x000800000001bb2d-185.dat family_cosmu behavioral2/files/0x000400000001bb42-189.dat family_cosmu - Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\K: 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\N: 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\D: 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\J: 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\L: 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\M: 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\O: 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\G: 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\H: 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX6F3C.tmp 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX6F70.tmp 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\crashreporter.cab 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX6E04.tmp 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.cab 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.cab 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX6FA3.tmp 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7z.cab 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX6F3B.tmp 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX6F4D.tmp 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.cab 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCX7146.tmp 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX6FC5.tmp 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.cab 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX70AE.tmp 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX70AF.tmp 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX6FD7.tmp 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7zFM.exe 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7zFM.cab 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ExtExport.cab 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.cab 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.cab 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCX6E7D.tmp 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX6FC4.tmp 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX6FF8.tmp 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ieinstal.cab 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.cab 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX706B.tmp 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.cab 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX6F73.tmp 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX6DD4.tmp 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX6F4F.tmp 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iediagcmd.cab 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX6FC3.tmp 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX6E39.tmp 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX70BF.tmp 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\readme.1xt 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome.cab 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.cab 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7z.cab 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX6DC4.tmp 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\dotnet.cab 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.cab 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.cab 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX6F4E.tmp 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.cab 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-05_ba89520c9159feaf0455f2b6f529262f_elex_rhadamanthys_smoke-loader.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3400
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 322KB
- SHA256 e7f0da3448fcdbf05563feccd1c622f09ef220c9fc80523fc234a8b04bc682ff
- MD5 95d888981cbc12de4790125d2b1e2ab2
- SHA1 15a5e3e97d5752a2a58e6a3100dac70b7cf94519
- SHA512 52124c89a47f948cedf6f34ea0d60b43562e2fd7e1619956a747c62e2d026cce5d3f53084389ecf4313300edc8101f4dbb96871411bd96a74d32c5f832e5fada
- SSDEEP 6144:iFlKgzelZNQSBQGH/CSpWqTyoAXjiU4bz:lfBQGH6SfeoAX+U4
- TLSH T14764F1457D93C4B3E0414D31C9E68AE14B7E6C037AA6E11BFF5D0B4B1EB13884BA66B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX707C.tmp
- Size 284KB
- SHA256 f3a75493766d523d8d58b6b9111eaee2f5ed24ed82ec4b724f041fab3d778f6a
- MD5 85faf0517a4243fd178124224d6ecafb
- SHA1 524d437c99459e0b2d5593b516e6810c59633ab4
- SHA512 5db2c5c55601923bc6d63b62c605e57fb9065ee5d0dec6068bbca7800e87072545c7c6a4bfa56574e8737bf668bf8a17839a91dde4778d9730cbbca0d0df999c
- SSDEEP 6144:CFlKgzelZNQSBQGH/CSpWqTfoAXjiU4bz:FfBQGH6SfzoAX+U4
- TLSH T1CF5402457D93D4B3D0414D3188E78BE18B7F6C137AA6E11BFB9D0B4B1EB13884BA6261
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX707D.tmp
- Size 284KB
- SHA256 5c8683f4dc679a152263604cf5c519a10dc7b784945d91f5e0c8b99194d69641
- MD5 1b680fe692f40f23ebc3145b415305f2
- SHA1 23379926807704b41eab33838ec60ae03b612c0c
- SHA512 c972370ff5a22ceddf5215c3ee11cf497842f809bd86086074bbcda4eb0587512af59b7b27d1556b93df1e4a2ce83337a44ff0defd25d3bc9b09ae608c92affa
- SSDEEP 6144:6FlKgzelZNQSBQGH/CSpWqTZoAXjiU4bz:dfBQGH6Sf9oAX+U4
- TLSH T1BF5402457DA3C4B3D0414D3188E68BE19B7F6C137AA6E11BFB9D0B4B1EB13844B6A361
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\RCX6F4D.tmp
- Size 284KB
- SHA256 0123072844bff21384533fdff9d60d5bb3d27bfc96c5c8124dd343bec9db029e
- MD5 6eed6cda7dec16d56adf26b790e30ed4
- SHA1 072657348551d695034c78e1a0f59d1e8e52f976
- SHA512 791bacfe071177eb3a8da24f9530288659c4f1d33734e03fa986f247415106e861a3d7029af597dfd7d08cbef27db999b54821d758219cf848c9b502309c3468
- SSDEEP 6144:+FlKgzelZNQSBQGH/CSpWqTAoAXjiU4bz:5fBQGH6Sf0oAX+U4
- TLSH T1EC54F1457D93C4B3D0414D31C9E68BE14B7E6C037AA6E11BFB5D0B4B1EB13884BAA6B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome.exe
- Size 1.5MB
- SHA256 0edfc4919ba72c4270b7d2e25a81c360df65b1c2bf80aafbfdb35dfc0bbb0ba1
- MD5 9f8262d5c1838bf0e4d8cc159f146e60
- SHA1 86693064f75abfc0181670d30b1660acf5a5edca
- SHA512 c320d368d5ef819a6c60cdf6949f26a2a87b0202980e488a18e7114abfd508e6cf70f7739204355618c0023b95d09c1210161d1728a9f79552736b3ef8f0066b
- SSDEEP 6144:QFlKgzelZNQSBQGH/CSpWqT2arTQdoAXjiU4bz:nfBQGH6Sfy1doAX+U4
- TLSH T10765F1157D93DA73D040C931999787D0877E7C0BA696D127FBA83A8B1FB02DC0B761A2
- MD5 SHA1 SHA512 SSDEEP TLSH