bd357c966e4fc81882db0a18b13915abc3b24d80a7efa0d192d67743b4da2518

General

Target
2026-07-30_51c9608bdd05e028591acb3bacddc7a5_elex_remcos_wannacry.exe
Size 46KB
Sample260730-wancssteme
SHA256 bd357c966e4fc81882db0a18b13915abc3b24d80a7efa0d192d67743b4da2518
MD5 51c9608bdd05e028591acb3bacddc7a5
SHA1 9b2bb21782188538e18ff6f61fd2b5664fd89111
SHA512 24ce9795ff181a161d3a5620048186ed6f916f94bfa63556b85d83e6c76a5f6258d19034c2456c99fbd24e9a288a4dee769a0afa37bc2db1430692c7118ce76f
SSDEEP 768:i96YcrtoDHUEWBGxsQz7cu1eQ47/TV+lw5jm/epzGTf/B7RVhYY+8mmr1z1:ioBSzUB2b1eDQw5jvATf/B73hvmmr51
TLSH
T14223E703BF0641B2D56502F006446B13EFFD5CDA0A49A277DB45C500BEFABAAD4A277E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	2026-07-30_51c9608bdd05e028591acb3bacddc7a5_elex_remcos_wannacry.exe

Executes dropped EXE 1 IoCs

pid	Process
6056	remcos.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\REMCOS = "\"C:\\Windows\\System32\\remcos.exe\""	2026-07-30_51c9608bdd05e028591acb3bacddc7a5_elex_remcos_wannacry.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\remcos.exe	2026-07-30_51c9608bdd05e028591acb3bacddc7a5_elex_remcos_wannacry.exe
File opened for modification	C:\Windows\SysWOW64\remcos.exe	2026-07-30_51c9608bdd05e028591acb3bacddc7a5_elex_remcos_wannacry.exe
File created	C:\Windows\SysWOW64\remcos.exe	remcos.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6124	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_51c9608bdd05e028591acb3bacddc7a5_elex_remcos_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5368	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
5368	PING.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 6080 wrote to memory of 6124	6080	2026-07-30_51c9608bdd05e028591acb3bacddc7a5_elex_remcos_wannacry.exe	84
PID 6124 wrote to memory of 5368	6124	cmd.exe	86
PID 6124 wrote to memory of 6056	6124	cmd.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-30_51c9608bdd05e028591acb3bacddc7a5_elex_remcos_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_51c9608bdd05e028591acb3bacddc7a5_elex_remcos_wannacry.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6080
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6124
- - C:\Windows\SysWOW64\PING.EXE
    PING 127.0.0.1 -n 2
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5368
- - C:\Windows\SysWOW64\remcos.exe
    "C:\Windows\System32\remcos.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:6056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

Remote System Discovery

1

T1018

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

install.bat

Path C:\Users\Admin\AppData\Local\Temp\install.bat
Size 81B
SHA256 58e2c2bc7b7cdaf27e338b7b9b110c3421a826693c93b3efc5601664acb51d8a
MD5 5762514c1ac39f76247acb1367b0bf32
SHA1 2df98c005e7ba438800bd27d0768ac4388b41fa9
SHA512 523df964fbc85b27e0f57d82218991507fbc4a55ed110a54897e055b6fb579332dcf2ceb0e754140adc774a52d5decf6b2ebc0bbf42eae990c02aa84279b09a4
TLSH
T19DA024710F1040F755130D344C4C7D75F101F0D550037414144F10D0CC330017CC1D10
MD5 SHA1 SHA512 TLSH

Submit Download

remcos.exe

Path C:\Windows\SysWOW64\remcos.exe
Size 46KB
SHA256 bd357c966e4fc81882db0a18b13915abc3b24d80a7efa0d192d67743b4da2518
MD5 51c9608bdd05e028591acb3bacddc7a5
SHA1 9b2bb21782188538e18ff6f61fd2b5664fd89111
SHA512 24ce9795ff181a161d3a5620048186ed6f916f94bfa63556b85d83e6c76a5f6258d19034c2456c99fbd24e9a288a4dee769a0afa37bc2db1430692c7118ce76f
SSDEEP 768:i96YcrtoDHUEWBGxsQz7cu1eQ47/TV+lw5jm/epzGTf/B7RVhYY+8mmr1z1:ioBSzUB2b1eDQw5jvATf/B73hvmmr51
TLSH
T14223E703BF0641B2D56502F006446B13EFFD5CDA0A49A277DB45C500BEFABAAD4A277E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads