Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/11/2026, 14:12
Behavioral task
behavioral1
Sample
2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe
- Size 347KB
- Sample261107-rh1kwafb46
- SHA256 031d7df55f01530673057a309c9d4bd77748a74a6889de3604cc2897be293cad
- MD5 5488c0369a8315509ec3e9e60902dda3
- SHA1 065fea5c4f744a004e1df33f2376ed012f53a3bc
- SHA512 9c66e95e2aa36a3db3cd2d366f75c9df9e11a76edc64fb24186b7b500499731f29106631e2eb256141dc507b27f2729b8871260cb8ca6eedb31140e8b4448135
- SSDEEP 6144:CFlKgzelZNQSBQGH/CSpWqTNw/oAXjiU4bz:FfBQGH6SfG/oAX+U4
- TLSH T14674D0003A9ECBB2D3C249318CAEFAE1477A7C2FAB559137F7983B0F1E712845656251
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000e00000001c4a5-3.dat family_cosmu behavioral2/files/0x000400000001ba7f-86.dat family_cosmu behavioral2/files/0x000600000001ba7f-120.dat family_cosmu behavioral2/files/0x000300000001ba81-185.dat family_cosmu - Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\J: 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\M: 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\N: 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\D: 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\H: 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\K: 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\L: 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\O: 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe File opened (read-only) \??\G: 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\Application\chrome.cab 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.cab 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.cab 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\Office16\RCX2276.tmp 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX210B.tmp 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX213D.tmp 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.cab 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCX22B9.tmp 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX20A6.tmp 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX20FA.tmp 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ieinstal.cab 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\dotnet.exe 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCX1F91.tmp 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX20C8.tmp 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX2253.tmp 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.cab 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX1ECA.tmp 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\RCX1F1C.tmp 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX217F.tmp 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.cab 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.cab 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX204F.tmp 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX211C.tmp 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\crashreporter.cab 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCX1F92.tmp 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX20C9.tmp 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX217E.tmp 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX21F2.tmp 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.cab 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX2297.tmp 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.cab 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCX1F70.tmp 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.cab 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.cab 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iexplore.exe 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX2298.tmp 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\dotnet\RCX1F60.tmp 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX21E1.tmp 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX1F2D.tmp 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX20B7.tmp 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\ExtExport.cab 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.cab 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-07_5488c0369a8315509ec3e9e60902dda3_elex_rhadamanthys_smoke-loader.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5952
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 288KB
- SHA256 1268687db40092f2f6b1c6cf4c130cf57e88c3532632d87382d6125ce5d36ad3
- MD5 fe59a54eb9b8fc5e969afee97192e534
- SHA1 8fadf17056a864e5862349615ccc0bc15a64ca70
- SHA512 9fdeedd6296aed3bf79782f63a0370813bb308bcda75a1e72124ccb8d6c1787a5bffbeb62330aeb7f7c3d6ab7325ca54f3f8142072c04333409a1ddc75fcaf52
- SSDEEP 6144:uFlKgzelZNQSBQGH/CSpWqTvoAXjiU4bz:JfBQGH6SfboAX+U4
- TLSH T19C5401817DA3D8B3D041493188A6CBA1973B6D13AA65D203FB9D0F4B2FB13D49B7A251
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 1.5MB
- SHA256 acb20179b8f01ede5dad48379f4b572e1c947dbafc0b329ea8c03ea190f67128
- MD5 234738bb3f5c2af3f5f38248ced58538
- SHA1 5a374a44b6bb7478d5b9d4050f1852cf8eabc6fb
- SHA512 ef18b43b19b28eb4da9899179264ed3023bd93c250ac281c0850bd1e36c5c2d7b2a2c475e759ec8b30e884c7200eab135b68569d902122f54dcef8407f115090
- SSDEEP 6144:GFlKgzelZNQSBQGH/CSpWqTjoAXjiU4bz:hfBQGH6Sf3oAX+U4
- TLSH T1966501817DA2D8B3C4414A3288A7CFA197376D139A65D203F7AD1F4B2F713D49B7A205
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\RCX2062.tmp
- Size 288KB
- SHA256 1b8f70ffa6f78cbaa5e994cbca494bbe67fab536d5be6e6653adf8a15d8ca2ac
- MD5 b29b12fb909f0e1401cdf84c0adadc02
- SHA1 439fe6092c270100c6a98c5850817de016d2ec63
- SHA512 1961313f55710cf0f04476c40a428b6eba7ee323a7562f59babfcc659d0a3342d1b533e5c558af00d4371b7493523992d65d4b02d11ea5a19a17459d1c12f22e
- SSDEEP 6144:CFlKgzelZNQSBQGH/CSpWqTYoAXjiU4bz:FfBQGH6Sf8oAX+U4
- TLSH T1915401917DA2D8B3D041493188A6CFA1973B6D13AA65D203FB9D0F4B2FB13D49B7B241
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome.exe
- Size 1.5MB
- SHA256 d18749973436d133ee3c04a87a96fc7d5c1dafd3e40cd904d51f85206e5bbd2d
- MD5 2ebc65f10232d3637498ea400a5339bb
- SHA1 3d8e8086a5cb1ca25e89302492391ab1398b2838
- SHA512 8b2af3d607f3f1453c96c8e6a763d6fdf7af6faa2ab29ebe63d82996e78fce1ec7faaae59191fc443a987ab662e3c8932a9c8b47e5549656e2a4d33c1d59a6ed
- SSDEEP 6144:ZFlKgzelZNQSBQGH/CSpWqTBGYxlkBx32oAXjiU4bz:ufBQGH6SfdGYUBAoAX+U4
- TLSH T14B650141BAD2ECF3C04142324CA7CB615736AD178A75C603BB9D2F4B2EB23D156B7646
- MD5 SHA1 SHA512 SSDEEP TLSH