Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
10/08/2026, 12:22
General
- Target 2026-08-10_2805194761a4c12a94db95054748e2ce_elex_remcos_wannacry.exe
- Size 64KB
- Sample260810-pj49caycmd
- SHA256 e4bb5279976ef726b8902ccdd0439b0aab7abf00a72c5c163f43d3636707e1ab
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 33 IoCs
- Detects Windows executables referencing non-Windows User-Agents 33 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_2805194761a4c12a94db95054748e2ce_elex_remcos_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_2805194761a4c12a94db95054748e2ce_elex_remcos_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F449502E-3BAB-4219-94DA-F93855EA94CA}.exeC:\Windows\{F449502E-3BAB-4219-94DA-F93855EA94CA}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EEEB8AA3-564F-4304-BA1D-BA8977CAF0CA}.exeC:\Windows\{EEEB8AA3-564F-4304-BA1D-BA8977CAF0CA}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{082D7C4E-4D84-488d-9815-101CCB81B7D3}.exeC:\Windows\{082D7C4E-4D84-488d-9815-101CCB81B7D3}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{20C3F524-B146-4b65-9E34-1FEB885C24EC}.exeC:\Windows\{20C3F524-B146-4b65-9E34-1FEB885C24EC}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E1E36AAD-67A0-4e79-8A06-9E8670BEF521}.exeC:\Windows\{E1E36AAD-67A0-4e79-8A06-9E8670BEF521}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1D1F95E7-8999-4c45-A9A3-2A34AEFB82DE}.exeC:\Windows\{1D1F95E7-8999-4c45-A9A3-2A34AEFB82DE}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E0F236BE-2FA9-48e4-BDC3-3072409F1A73}.exeC:\Windows\{E0F236BE-2FA9-48e4-BDC3-3072409F1A73}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1F7AAB85-B64D-45c9-AAFB-73B710D72C15}.exeC:\Windows\{1F7AAB85-B64D-45c9-AAFB-73B710D72C15}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7A4EBCCB-A3E9-4687-9C02-CA207E21E48F}.exeC:\Windows\{7A4EBCCB-A3E9-4687-9C02-CA207E21E48F}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9D952A11-2465-40cf-B8A3-D3DC75536AD2}.exeC:\Windows\{9D952A11-2465-40cf-B8A3-D3DC75536AD2}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E91A1F4C-AC9C-4f70-AC55-106121D9E0EA}.exeC:\Windows\{E91A1F4C-AC9C-4f70-AC55-106121D9E0EA}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9D952~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7A4EB~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1F7AA~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E0F23~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1D1F9~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E1E36~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{20C3F~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{082D7~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EEEB8~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F4495~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{082D7C4E-4D84-488d-9815-101CCB81B7D3}.exe
{1D1F95E7-8999-4c45-A9A3-2A34AEFB82DE}.exe
{1F7AAB85-B64D-45c9-AAFB-73B710D72C15}.exe
{20C3F524-B146-4b65-9E34-1FEB885C24EC}.exe
{7A4EBCCB-A3E9-4687-9C02-CA207E21E48F}.exe
{9D952A11-2465-40cf-B8A3-D3DC75536AD2}.exe
{E0F236BE-2FA9-48e4-BDC3-3072409F1A73}.exe
{E1E36AAD-67A0-4e79-8A06-9E8670BEF521}.exe
{E91A1F4C-AC9C-4f70-AC55-106121D9E0EA}.exe
{EEEB8AA3-564F-4304-BA1D-BA8977CAF0CA}.exe
{F449502E-3BAB-4219-94DA-F93855EA94CA}.exe
memory/1100-22-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1244-64-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1808-53-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1808-57-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1964-46-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1964-51-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2152-17-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2152-12-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2236-30-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2236-34-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2932-28-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2932-24-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3960-59-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3960-63-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4060-41-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4288-10-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4288-7-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4668-44-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4668-39-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5028-1-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5028-0-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5028-6-0x0000000000400000-0x0000000000410000-memory.dmp