Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
09/08/2026, 13:59
General
- Target 2026-08-09_99515d8513109fb26e4cb2f2beaaaf9a_elex_remcos_wannacry.exe
- Size 64KB
- Sample260809-raw8gsygmd
- SHA256 57e7a1446fd3bcf8e34ae1f60fa97d5112628f0d61fa5062c9b9f763b6690ba4
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 36 IoCs
- Detects Windows executables referencing non-Windows User-Agents 36 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_99515d8513109fb26e4cb2f2beaaaf9a_elex_remcos_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_99515d8513109fb26e4cb2f2beaaaf9a_elex_remcos_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5531F884-1A55-4e18-B89C-8C691E115D46}.exeC:\Windows\{5531F884-1A55-4e18-B89C-8C691E115D46}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EF842D1F-5412-41ad-B13D-FCDBFC58222A}.exeC:\Windows\{EF842D1F-5412-41ad-B13D-FCDBFC58222A}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1B8B9628-C534-4979-91DB-983B929B0B0B}.exeC:\Windows\{1B8B9628-C534-4979-91DB-983B929B0B0B}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9E2473C9-A93D-4306-8806-3E9742262BC8}.exeC:\Windows\{9E2473C9-A93D-4306-8806-3E9742262BC8}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{20318496-0D29-4aff-AE5A-F430F4AE290F}.exeC:\Windows\{20318496-0D29-4aff-AE5A-F430F4AE290F}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{84262D4C-1A96-4478-A369-21D1CEE5191E}.exeC:\Windows\{84262D4C-1A96-4478-A369-21D1CEE5191E}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1A23965A-37F5-42c0-BAC6-31CB7C6B2FFF}.exeC:\Windows\{1A23965A-37F5-42c0-BAC6-31CB7C6B2FFF}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{21A6A375-0B0A-45f7-BAD9-5BA261E9BCE8}.exeC:\Windows\{21A6A375-0B0A-45f7-BAD9-5BA261E9BCE8}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{97F9AE26-7F6F-4f74-8E49-9D51BF02695C}.exeC:\Windows\{97F9AE26-7F6F-4f74-8E49-9D51BF02695C}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CD79F8CF-FE03-468b-885C-91753EAB11A4}.exeC:\Windows\{CD79F8CF-FE03-468b-885C-91753EAB11A4}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6C7AD4A6-C423-4e7d-ACD0-2677F169D335}.exeC:\Windows\{6C7AD4A6-C423-4e7d-ACD0-2677F169D335}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CD79F~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{97F9A~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{21A6A~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1A239~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{84262~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{20318~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9E247~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1B8B9~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EF842~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5531F~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{1A23965A-37F5-42c0-BAC6-31CB7C6B2FFF}.exe
{1B8B9628-C534-4979-91DB-983B929B0B0B}.exe
{20318496-0D29-4aff-AE5A-F430F4AE290F}.exe
{21A6A375-0B0A-45f7-BAD9-5BA261E9BCE8}.exe
{5531F884-1A55-4e18-B89C-8C691E115D46}.exe
{6C7AD4A6-C423-4e7d-ACD0-2677F169D335}.exe
{84262D4C-1A96-4478-A369-21D1CEE5191E}.exe
{97F9AE26-7F6F-4f74-8E49-9D51BF02695C}.exe
{9E2473C9-A93D-4306-8806-3E9742262BC8}.exe
{CD79F8CF-FE03-468b-885C-91753EAB11A4}.exe
{EF842D1F-5412-41ad-B13D-FCDBFC58222A}.exe
memory/480-70-0x0000000000400000-0x0000000000410000-memory.dmp
memory/480-65-0x0000000000400000-0x0000000000410000-memory.dmp
memory/480-63-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2148-19-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2148-14-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2548-56-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2548-48-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2812-28-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2812-21-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3032-6-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3032-12-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3184-78-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3408-49-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3408-41-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4444-33-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4444-27-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4468-42-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4468-35-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4932-7-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4932-0-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4932-1-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5100-55-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5100-61-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5964-71-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5964-76-0x0000000000400000-0x0000000000410000-memory.dmp