a4bd25496aaf7e2a5e237e89ae87af67b009e2c97f686a03c2d2f11659bd7da7

General

Target
2026-08-03_6b80f14e757de59c4163315cb1f5efd9_elex_remcos_wannacry.exe
Size 84KB
Sample260803-rxgfjsba35
SHA256 a4bd25496aaf7e2a5e237e89ae87af67b009e2c97f686a03c2d2f11659bd7da7
MD5 6b80f14e757de59c4163315cb1f5efd9
SHA1 a723483b31051a51c6035de96894e5f265f7f26e
SHA512 010cc123ac0973d7b2c5239eaff2f6cb66eddc4a2a52e17cb6400264e75704e9ef668e07181182da615a8f99a796ef1e9cb5475e5a74a0c9a1544a111495b280
SSDEEP 1536:6jE2Ra5ZWtRyUFS40YQcpggDaM1nyS1loLIL:yR6WRyUFS40YQxMB8I
TLSH
T108835C03A584B5F1EB680135F19F1F7E5A3B86B1C0DC6C2F5B638DA958A2867F421E13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Signatures

Detects Windows executables referencing non-Windows User-Agents 2 IoCs

resource	yara_rule
behavioral1/files/0x000300000001e6a4-2.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x000300000001e6ec-6.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Executes dropped EXE 2 IoCs

pid	Process
2324	aE6234B4B4CC8Cs4bd2694E8f8B526C08C735a.exe
996	aF33C96294F7F0s442a6AFA6f758EC89421B5a.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\aF33C96294F7F0s442a6AFA6f758EC89421B5a.exe	aE6234B4B4CC8Cs4bd2694E8f8B526C08C735a.exe
File created	C:\Windows\aE6234B4B4CC8Cs4bd2694E8f8B526C08C735a.exe	2026-08-03_6b80f14e757de59c4163315cb1f5efd9_elex_remcos_wannacry.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1556	cmd.exe
1636	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_6b80f14e757de59c4163315cb1f5efd9_elex_remcos_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aE6234B4B4CC8Cs4bd2694E8f8B526C08C735a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aF33C96294F7F0s442a6AFA6f758EC89421B5a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4464	2026-08-03_6b80f14e757de59c4163315cb1f5efd9_elex_remcos_wannacry.exe
Token: SeIncBasePriorityPrivilege	2324	aE6234B4B4CC8Cs4bd2694E8f8B526C08C735a.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4464 wrote to memory of 2324	4464	2026-08-03_6b80f14e757de59c4163315cb1f5efd9_elex_remcos_wannacry.exe	90
PID 4464 wrote to memory of 1556	4464	2026-08-03_6b80f14e757de59c4163315cb1f5efd9_elex_remcos_wannacry.exe	91
PID 2324 wrote to memory of 996	2324	aE6234B4B4CC8Cs4bd2694E8f8B526C08C735a.exe	92
PID 2324 wrote to memory of 1636	2324	aE6234B4B4CC8Cs4bd2694E8f8B526C08C735a.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-08-03_6b80f14e757de59c4163315cb1f5efd9_elex_remcos_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_6b80f14e757de59c4163315cb1f5efd9_elex_remcos_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4464
- C:\Windows\aE6234B4B4CC8Cs4bd2694E8f8B526C08C735a.exe
  C:\Windows\aE6234B4B4CC8Cs4bd2694E8f8B526C08C735a.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2324
- - C:\Windows\aF33C96294F7F0s442a6AFA6f758EC89421B5a.exe
    C:\Windows\aF33C96294F7F0s442a6AFA6f758EC89421B5a.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:996
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\AE6234~1.EXE > nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1636
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aE6234B4B4CC8Cs4bd2694E8f8B526C08C735a.exe

Path C:\Windows\aE6234B4B4CC8Cs4bd2694E8f8B526C08C735a.exe
Size 84KB
SHA256 d1c77b21c2ab080294f801f1aa50c48650ba8918485ccf7c764f7bb96b747ff2
MD5 b2725c68dad1e2c29ab962ea8afac5d6
SHA1 2c5ec70fc64b34540f26a108051230b0bbb0484a
SHA512 7a21c28d080682a125ad93c81a3edde93005b78e747a19cbd2e5f9e004a167ba6efcbd78693148b1cc2e3485a5f2636c6fd2cadb4b5489b800ed8dcc0b6e3702
SSDEEP 1536:6jE2Ra5ZWtRTUFS40YQcpggDaM1nyS1loLIL:yR6WRTUFS40YQxMB8I
TLSH
T121835C03A584B5F1EB680135F19F1F7E563B86B1C0DC6C2F5B638DA958A2867F421E13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aF33C96294F7F0s442a6AFA6f758EC89421B5a.exe

Path C:\Windows\aF33C96294F7F0s442a6AFA6f758EC89421B5a.exe
Size 84KB
SHA256 964cb1e55a178ea11bac0bb86fffea0b02934cd706e8a63e56a666a0b0975fdb
MD5 d014f3be0932c964a9c794fd07ccfad5
SHA1 ba61494e5e5f69a0033e02a407196af18b60f725
SHA512 f28f53ff4d124a8a2163c6505d718cd98fe5a86a5ccf837f24254b895212fec4677afff882f454703b385f86a1959a5545ca5a92396247ec17bcfe87620f2d2b
SSDEEP 1536:6jE2Ra5ZWtRsUFS40YQcpggDaM1nyS1loLIL:yR6WRsUFS40YQxMB8I
TLSH
T171835C03A584B5F1EB680135F19F1F7E563B86B1C0DC6C2F5B638DA958A2867F421E13
MD5 SHA1 SHA512 SSDEEP TLSH