Analysis
- max time kernel
148s - max time network
140s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
07/08/2026, 17:29
General
- Target 2026-08-07_5268d3bd1070289e554a8cb1a9b91919_elex_remcos_wannacry.exe
- Size 64KB
- Sample260807-v2verazgpg
- SHA256 efa85a6a14bcb5fa4e76bc33b24b8cc3af5df65cad6480822cd52d62fc141fe6
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 35 IoCs
- Detects Windows executables referencing non-Windows User-Agents 35 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_5268d3bd1070289e554a8cb1a9b91919_elex_remcos_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-07_5268d3bd1070289e554a8cb1a9b91919_elex_remcos_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{91F26D2B-A84C-466c-B794-94216811A38B}.exeC:\Windows\{91F26D2B-A84C-466c-B794-94216811A38B}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{04C3D9FF-1B74-425d-8B67-22C208185668}.exeC:\Windows\{04C3D9FF-1B74-425d-8B67-22C208185668}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{734BD3D3-501E-4200-A681-C906568B240B}.exeC:\Windows\{734BD3D3-501E-4200-A681-C906568B240B}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{48AD7848-7557-4429-87C5-756D651C111A}.exeC:\Windows\{48AD7848-7557-4429-87C5-756D651C111A}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5083F08F-0C31-427e-9245-0D66CAC99C79}.exeC:\Windows\{5083F08F-0C31-427e-9245-0D66CAC99C79}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1DE0589F-C045-4096-A5C7-81C5DF3C6B3C}.exeC:\Windows\{1DE0589F-C045-4096-A5C7-81C5DF3C6B3C}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AC97B511-D756-4593-B5F5-2CE0E8513CDD}.exeC:\Windows\{AC97B511-D756-4593-B5F5-2CE0E8513CDD}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{52B482F4-FB8D-4635-9AA0-24A54848A96D}.exeC:\Windows\{52B482F4-FB8D-4635-9AA0-24A54848A96D}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9F3B8800-3D9F-4edb-9B43-8E237D9F2366}.exeC:\Windows\{9F3B8800-3D9F-4edb-9B43-8E237D9F2366}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A88B62D3-0D4D-49e5-956C-5B3F42281880}.exeC:\Windows\{A88B62D3-0D4D-49e5-956C-5B3F42281880}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F92236B4-41BD-49d4-9CC5-330D15F7E805}.exeC:\Windows\{F92236B4-41BD-49d4-9CC5-330D15F7E805}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A88B6~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9F3B8~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{52B48~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AC97B~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1DE05~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5083F~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{48AD7~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{734BD~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{04C3D~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{91F26~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{04C3D9FF-1B74-425d-8B67-22C208185668}.exe
{1DE0589F-C045-4096-A5C7-81C5DF3C6B3C}.exe
{48AD7848-7557-4429-87C5-756D651C111A}.exe
{5083F08F-0C31-427e-9245-0D66CAC99C79}.exe
{52B482F4-FB8D-4635-9AA0-24A54848A96D}.exe
{734BD3D3-501E-4200-A681-C906568B240B}.exe
{91F26D2B-A84C-466c-B794-94216811A38B}.exe
{9F3B8800-3D9F-4edb-9B43-8E237D9F2366}.exe
{A88B62D3-0D4D-49e5-956C-5B3F42281880}.exe
{AC97B511-D756-4593-B5F5-2CE0E8513CDD}.exe
{F92236B4-41BD-49d4-9CC5-330D15F7E805}.exe
memory/1268-49-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1268-54-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1320-41-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1320-35-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1632-14-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1632-6-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2616-75-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2616-70-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2892-77-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4256-19-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4256-13-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4280-0-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4280-7-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4280-1-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4484-42-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4484-47-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4772-21-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4772-26-0x0000000000400000-0x0000000000410000-memory.dmp
memory/6540-62-0x0000000000400000-0x0000000000410000-memory.dmp
memory/6540-56-0x0000000000400000-0x0000000000410000-memory.dmp
memory/6768-63-0x0000000000400000-0x0000000000410000-memory.dmp
memory/6768-68-0x0000000000400000-0x0000000000410000-memory.dmp
memory/6964-34-0x0000000000400000-0x0000000000410000-memory.dmp
memory/6964-28-0x0000000000400000-0x0000000000410000-memory.dmp