Overview

overview

10

Static

static

10

2026-11-09...er.exe

windows10-2004-x64

10

2026-11-09...er.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    125s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/11/2026, 02:04

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-09_ed3ed01e80fa68c6e136f9480e6baf61_elex_rhadamanthys_smoke-loader.exe
  • Size 288KB
  • Sample261110-chpfaaf12y
  • SHA256 419e79ed2ced7e4d243ed2804f2635a0f3f7d6c762adbe9022195b208655dfd3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarediscoverycosmuransomwarespywareworm

Malware Config

Signatures

  • Family: Cosmu

    Cosmu is a Windows worm written in C++.

    wormcosmu
  • Detects Cosmu payload 5 IoCs

    Cosmu is a worm written in C++.

  • Enumerates connected drives 3 TTPs 10 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-09_ed3ed01e80fa68c6e136f9480e6baf61_elex_rhadamanthys_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-09_ed3ed01e80fa68c6e136f9480e6baf61_elex_rhadamanthys_smoke-loader.exe"
    1⤵
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    PID:2940

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.cab
        • Path C:\Program Files\7-Zip\7z.cab
        • Size 549KB
        • SHA256 707f415d7d581edd9bce99a0429ad4629d3be0316c329e8b9ebd576f7ab50b71
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 330KB
        • SHA256 4f5dfe75e0f86d77866ea19a6d1a54288b3162c59f990fbbcc5c164b6b63ee0d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.cab
        • Path C:\Program Files\7-Zip\7zFM.cab
        • Size 963KB
        • SHA256 028cf2158df45889e9a565c9ce3c6648fb05c286b97f39c33317163e35d6f6be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RCX3FEF.tmp
        • Path C:\Program Files\7-Zip\RCX3FEF.tmp
        • Size 288KB
        • SHA256 6c7017fc86ec2d0231ff58f5eecc5c12b66d995727b2dbf8980a0bb366605795
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.cab
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab
        • Size 281KB
        • SHA256 6d54694077faf07473196da7b7f1c6981c8ad6a462fcea4777a80cfc6bc5769e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.cab
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab
        • Size 2.1MB
        • SHA256 7e0976036431640ae1d9f1c0b52bcea5dd37ef86cd3f5304dc8a96459d9483cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RCX442C.tmp
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX442C.tmp
        • Size 292KB
        • SHA256 d8be1dd78ef007526a436680c0a696bbc7b303b9e366f57567d8e0723b87fce2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.cab
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.cab
        • Size 6.1MB
        • SHA256 ca434df4bbfcadf6a6610a6bbea4eb435adb91751670f63c0a6bc3207e4a89a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.cab
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab
        • Size 1.7MB
        • SHA256 415ddfcaeb5f4240359dd12ed5cc53610c27d144ce44df6013ea5f6546102080
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.cab
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.cab
        • Size 3.5MB
        • SHA256 e0004b24f9d4e74eff4e221871e5bb7233b57033f5725c5d5c67c07f0a8976ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RCX4167.tmp
        • Path C:\Program Files\Google\Chrome\Application\RCX4167.tmp
        • Size 288KB
        • SHA256 408376e23c4ff6141dc2e5eb0bc6966db26b0922ad812bdcb8c4101218437278
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.cab
        • Path C:\Program Files\Google\Chrome\Application\chrome.cab
        • Size 3.1MB
        • SHA256 fdcfa390134b6d9a6bb68f9b7c452c01701e2b27fca1b9227e5b92f652df2457
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.cab
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.cab
        • Size 1.4MB
        • SHA256 79587605707bb61fde6eb92ee778b2e2a01725daac73e07f1569f9de4368f72b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.cab
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab
        • Size 23KB
        • SHA256 ea8543b0eab31dece2b50ef45a2585f4de09af35c68d9a63152944f8a831ac29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.cab
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.cab
        • Size 23KB
        • SHA256 955f386e3af5d87a46dcb2064967e34eb25a44ca3d2436e54bd5b84f4a2ab2ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RCX4520.tmp
        • Path C:\Program Files\Java\jre-1.8\bin\RCX4520.tmp
        • Size 288KB
        • SHA256 d5756770e418141e71595a68ece7e915b52dbfbec44fccb2bf21fc2cbf2d31bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.cab
        • Path C:\Program Files\Java\jre-1.8\bin\jabswitch.cab
        • Size 44KB
        • SHA256 7f1b10f0679401e5360f7e0baf903035728a631c03056b7d40dbb6ae734fecae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.cab
        • Path C:\Program Files\Java\jre-1.8\bin\java-rmi.cab
        • Size 23KB
        • SHA256 ee8ecfd717dfde63ff423f21fca560d80ec333ebfe2d55aba23fb7a1c4bffaaf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OSPPREARM.cab
        • Path C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab
        • Size 238KB
        • SHA256 ac66bafa0e7196b9f7b4a83b9625b32e83db7731418ecd0f4a8de474f7355254
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        crashreporter.cab
        • Path C:\Program Files\Mozilla Firefox\crashreporter.cab
        • Size 3.4MB
        • SHA256 180179d0b6cd38c05a5c6b42789517d8ff5e53123cef96004e27a476a069266b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        default-browser-agent.cab
        • Path C:\Program Files\Mozilla Firefox\default-browser-agent.cab
        • Size 34KB
        • SHA256 685f420616cb6ec8720f194bb9fdb45c79973f1976f2b3288f1efbf7b0fd0fde
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        helper.cab
        • Path C:\Program Files\Mozilla Firefox\uninstall\helper.cab
        • Size 1.3MB
        • SHA256 adeb96785772bef583c62e7796393cdb33489638dacce17b320704fb1844713d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.cab
        • Path C:\Program Files\dotnet\dotnet.cab
        • Size 143KB
        • SHA256 7ae20d0542a544b54730a5520a2c7b56dc9235be1a4dc1331763786a16fabed9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.cab
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab
        • Size 56KB
        • SHA256 6e25f414dd65440cd0c285990f4eef789a831fff640dadb4afdf79a5dfd95bc2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download