Analysis
- max time kernel
148s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
04/08/2026, 14:41
General
- Target 2026-08-04_a2fbd85c7e86c2933cadc69c0fc50280_elex_remcos_wannacry.exe
- Size 59KB
- Sample260804-r2tlnsgp4x
- SHA256 83402f720431fc1caccc70a3bac6da27691055265836853310abce8476046247
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Custom signatureDetects Windows executables referencing non-Windows User-Agents 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_a2fbd85c7e86c2933cadc69c0fc50280_elex_remcos_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_a2fbd85c7e86c2933cadc69c0fc50280_elex_remcos_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EB3AC7F8-1C31-4a27-B6D6-8042FF0AD7DD}.exeC:\Windows\{EB3AC7F8-1C31-4a27-B6D6-8042FF0AD7DD}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{447AA9C0-C641-45b1-AF26-C06F02F96CF9}.exeC:\Windows\{447AA9C0-C641-45b1-AF26-C06F02F96CF9}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F9C6D284-0E84-4167-A62E-166579FFAEDF}.exeC:\Windows\{F9C6D284-0E84-4167-A62E-166579FFAEDF}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D56E71B9-6F7C-4840-AEA7-C33CAF1A3C80}.exeC:\Windows\{D56E71B9-6F7C-4840-AEA7-C33CAF1A3C80}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4267A573-7C5F-4a38-B766-D84213DB7BAC}.exeC:\Windows\{4267A573-7C5F-4a38-B766-D84213DB7BAC}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5FC09C96-8617-4fa1-A255-EFD23C7B617D}.exeC:\Windows\{5FC09C96-8617-4fa1-A255-EFD23C7B617D}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2717B9F8-01B6-443d-822E-ED7D9D5BDBEA}.exeC:\Windows\{2717B9F8-01B6-443d-822E-ED7D9D5BDBEA}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{50316C29-CAE2-4772-93B6-90081334AC5A}.exeC:\Windows\{50316C29-CAE2-4772-93B6-90081334AC5A}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FE4927D4-A441-4ef2-9199-83C71BB6D27D}.exeC:\Windows\{FE4927D4-A441-4ef2-9199-83C71BB6D27D}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{817A9E1F-58F7-4392-8F9A-2501F13DE350}.exeC:\Windows\{817A9E1F-58F7-4392-8F9A-2501F13DE350}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CA6DFA0B-B41E-418b-945B-CEE887DA9542}.exeC:\Windows\{CA6DFA0B-B41E-418b-945B-CEE887DA9542}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{817A9~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FE492~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{50316~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2717B~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5FC09~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4267A~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D56E7~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F9C6D~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{447AA~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EB3AC~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{2717B9F8-01B6-443d-822E-ED7D9D5BDBEA}.exe
{4267A573-7C5F-4a38-B766-D84213DB7BAC}.exe
{447AA9C0-C641-45b1-AF26-C06F02F96CF9}.exe
{50316C29-CAE2-4772-93B6-90081334AC5A}.exe
{5FC09C96-8617-4fa1-A255-EFD23C7B617D}.exe
{817A9E1F-58F7-4392-8F9A-2501F13DE350}.exe
{CA6DFA0B-B41E-418b-945B-CEE887DA9542}.exe
{D56E71B9-6F7C-4840-AEA7-C33CAF1A3C80}.exe
{EB3AC7F8-1C31-4a27-B6D6-8042FF0AD7DD}.exe
{F9C6D284-0E84-4167-A62E-166579FFAEDF}.exe
{FE4927D4-A441-4ef2-9199-83C71BB6D27D}.exe