Analysis
- max time kernel
148s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/11/2026, 10:46
Behavioral task
behavioral1
Sample
2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe
- Size 288KB
- Sample261107-mt3gdsbs21
- SHA256 b55c6f40b4d57ef139ece88469aa6ec6bde848603e02a8a11a365a149d2b0f92
- MD5 b6c35dde4c7719c7a22d38e1fcadbed4
- SHA1 cfd93ec89f568db51e3f97d9854ae0e450812d6b
- SHA512 6a90a78640161ae132b52f11a09745cd98a435488e512e1f2e02056cc463c3faeaba070b5d46a594414a830f82495a2a2ebb8bb614124270c49e9d6359f1dad1
- SSDEEP 6144:QFlKgzelZNQSBQGH/CSpWqTLoAXjiU4bzF:nfBQGH6Sf3oAX+U41
- TLSH T18D5401917DA2D8B3C0419A314CA6CBA197376D139A65D203BBAD1F4B2F713D49B7B302
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Cosmu payload 5 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000e00000001c542-3.dat family_cosmu behavioral2/files/0x000d00000001c54e-86.dat family_cosmu behavioral2/files/0x000300000001bb7e-138.dat family_cosmu behavioral2/files/0x000d00000001c552-177.dat family_cosmu behavioral2/files/0x000300000001bb7c-186.dat family_cosmu - Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\I: 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\J: 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\N: 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\G: 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\H: 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\K: 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\L: 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\M: 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\O: 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX16B9.tmp 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX171D.tmp 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7zFM.cab 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX156C.tmp 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX15B3.tmp 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ExtExport.cab 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.cab 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX172F.tmp 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.cab 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7zFM.exe 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\dotnet.cab 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX1526.tmp 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCX1435.tmp 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX1527.tmp 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.cab 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.cab 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7z.cab 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX13BD.tmp 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX16B7.tmp 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX16E9.tmp 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX13E1.tmp 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX1580.tmp 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX1615.tmp 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCX1434.tmp 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCX1467.tmp 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.cab 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX156D.tmp 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ExtExport.exe 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ielowutil.cab 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.cab 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCX1741.tmp 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.cab 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX16A6.tmp 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCX1751.tmp 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\7-Zip\7z.cab 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX1636.tmp 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX13F2.tmp 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.cab 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\readme.1xt 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.cab 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\RCX170C.tmp 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX13E0.tmp 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX16EA.tmp 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX16FB.tmp 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX13BE.tmp 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX154B.tmp 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-07_b6c35dde4c7719c7a22d38e1fcadbed4_elex_rhadamanthys_smoke-loader.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1524
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 340KB
- SHA256 5269efc93cb7d1b01b1d21cb41e6b1f878bdffbb1ab9773b32dd66005340029a
- MD5 3c323f37b7c236d1459a8d71b9e34a3e
- SHA1 e00fa585c420b1618b2da7b7c879e3c5e42252a3
- SHA512 4b697e23f469d395b6e5c3027e8285b09400732571d389f4da777a9b8df3105dea51a64b4bfd466d96692828266360e1d6a45b7acb4d9b1e0cbaec8d7e5d9b11
- SSDEEP 6144:rFlKgzelZNQSBQGH/CSpWqTvoAXjiU4bz:UfBQGH6SfboAX+U4
- TLSH T1417401817DA3D8B3D041493188A6CBA1973B6D13AA65D203FB9D0F4B2FB13D49B7A251
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX1637.tmp
- Size 288KB
- SHA256 2f97785a62168ec8afb0f96a2cb2a0a901134a67ef2579c8996ee205ae9219eb
- MD5 13f62e274e0c6ce2d15e1c786fb319e6
- SHA1 7a6bf68cff47be485741c446ef5fe768cc8fb60a
- SHA512 81aa3752edbaf78d6d0d4a7973b929e8aa648227ee05554000ffca39d818ee44eca9e9f9a9fcb1faa30a6db2bbe8b031349ff4ba50a7f14036b6f59bc51e60de
- SSDEEP 6144:7FlKgzelZNQSBQGH/CSpWqTjoAXjiU4bz:EfBQGH6Sf3oAX+U4
- TLSH T1035401817DA2D8B3C4414A3288A78FA197376D139A65D203F7AD1F4B2F713D49B7A205
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 1.5MB
- SHA256 6f2597f45240bd8d44a8c0b804b8a76853a0481aff1d527cdcf3dacede192db3
- MD5 2f1e5d729b856fd7e649ca1127f081f3
- SHA1 60bbf05962090d2cb1c7cc20befe01934ce67941
- SHA512 771a5da1e572529e0872791100290fd4d68d1825ba5bcaa046f1ace90d12a02153c6dc8b97cc829aa950a806d8e4776e0aad1d7eaf5de651531fe9b25e308276
- SSDEEP 6144:7FlKgzelZNQSBQGH/CSpWqTSoAXjiU4bz:EfBQGH6Sf+oAX+U4
- TLSH T1C27501917EA2D8B3C0419A315CA68BA197377D139A65D203B7AD1F4B2F713D09B7A302
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\RCX1527.tmp
- Size 288KB
- SHA256 923c4bc3267dc12e0900065ea015814a12de586c981bd075bbc6d93ce8d0fe33
- MD5 8460638fdc2841c9afe2abbb744eaa03
- SHA1 187c4590343421db07f29c8254f7a2e1acc920fc
- SHA512 a84152141a6994e30e22d897ca3cf98da65b587279e133b4c22ef86d11d062eeec5ddb8c04413a4352152ac8d481632dc40822f2025c9f7b33f9d5a3e0d16873
- SSDEEP 6144:3FlKgzelZNQSBQGH/CSpWqTYoAXjiU4bz:ofBQGH6Sf8oAX+U4
- TLSH T1765401917DA2D8B3D041493188A6CFA1973B6D13AA65D203FB9D0F4B2FB13D49B7B241
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 340KB
- SHA256 9b0e080b5e53f7da0d54959762bb32cf4fc13bff8ac531d9c62289aa083c3984
- MD5 61557535a262877915a515523b7813d7
- SHA1 9ceb6d023e5e6780717a248d2dabf77e45db8410
- SHA512 f21334226afbd174d74747c88a37227f0e945a24108a48fcdb2522d0e8179d099ad426742b865ed542056943261470bacae0cf840c4fadd189e50d669db83a6c
- SSDEEP 6144:7FlKgzelZNQSBQGH/CSpWqT8oAXjiU4bz:EfBQGH6SfYoAX+U4
- TLSH T16274F1917EA2D8B3D0429A3148A68F6197377D139A65D203B7AD1F4B2F713D09B7B302
- MD5 SHA1 SHA512 SSDEEP TLSH