Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
11/08/2026, 03:57
General
- Target 2026-08-11_0758661a91749a929bfa80fdc0f4725c_elex_remcos_wannacry.exe
- Size 64KB
- Sample260811-ejd22s1tfv
- SHA256 6b5bb221b01f4e12f4088e5701ae6b8408c059e8249658c13c729e5f5e7d5e83
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 36 IoCs
- Detects Windows executables referencing non-Windows User-Agents 36 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-11_0758661a91749a929bfa80fdc0f4725c_elex_remcos_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-11_0758661a91749a929bfa80fdc0f4725c_elex_remcos_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AC6BD1FE-5F08-4ef2-B575-2048EAD3D854}.exeC:\Windows\{AC6BD1FE-5F08-4ef2-B575-2048EAD3D854}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DD2FFF00-5FE5-4ff5-8BED-C783181BCDF7}.exeC:\Windows\{DD2FFF00-5FE5-4ff5-8BED-C783181BCDF7}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F3716F30-0264-4da6-9B8E-CF685E72125D}.exeC:\Windows\{F3716F30-0264-4da6-9B8E-CF685E72125D}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7C41D2BB-3C08-438b-BFA0-6FBEA4243B04}.exeC:\Windows\{7C41D2BB-3C08-438b-BFA0-6FBEA4243B04}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C1A80C66-6F77-4c76-A68F-0C9602AAB9BD}.exeC:\Windows\{C1A80C66-6F77-4c76-A68F-0C9602AAB9BD}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{13C17333-E5F2-4c2c-8B33-8AEC1996882F}.exeC:\Windows\{13C17333-E5F2-4c2c-8B33-8AEC1996882F}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{46AFA51F-F19F-48cc-B327-C110FC681FEF}.exeC:\Windows\{46AFA51F-F19F-48cc-B327-C110FC681FEF}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A55D0325-BA59-4748-9CC3-1C10DB1904C5}.exeC:\Windows\{A55D0325-BA59-4748-9CC3-1C10DB1904C5}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{383985B4-E42B-426f-9A79-0AF58FFA2CD4}.exeC:\Windows\{383985B4-E42B-426f-9A79-0AF58FFA2CD4}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F1B1CAED-C348-450a-AF90-8CD5BB4EF312}.exeC:\Windows\{F1B1CAED-C348-450a-AF90-8CD5BB4EF312}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1360579B-384C-4fd3-BDE2-0C35E47A84F6}.exeC:\Windows\{1360579B-384C-4fd3-BDE2-0C35E47A84F6}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F1B1C~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{38398~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A55D0~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{46AFA~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{13C17~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C1A80~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7C41D~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F3716~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DD2FF~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AC6BD~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{1360579B-384C-4fd3-BDE2-0C35E47A84F6}.exe
{13C17333-E5F2-4c2c-8B33-8AEC1996882F}.exe
{383985B4-E42B-426f-9A79-0AF58FFA2CD4}.exe
{46AFA51F-F19F-48cc-B327-C110FC681FEF}.exe
{7C41D2BB-3C08-438b-BFA0-6FBEA4243B04}.exe
{A55D0325-BA59-4748-9CC3-1C10DB1904C5}.exe
{AC6BD1FE-5F08-4ef2-B575-2048EAD3D854}.exe
{C1A80C66-6F77-4c76-A68F-0C9602AAB9BD}.exe
{DD2FFF00-5FE5-4ff5-8BED-C783181BCDF7}.exe
{F1B1CAED-C348-450a-AF90-8CD5BB4EF312}.exe
{F3716F30-0264-4da6-9B8E-CF685E72125D}.exe
memory/260-34-0x0000000000400000-0x0000000000410000-memory.dmp
memory/260-28-0x0000000000400000-0x0000000000410000-memory.dmp
memory/260-30-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1736-14-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1736-6-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2008-62-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2008-57-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2144-43-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2144-36-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3084-69-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3084-64-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3248-20-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3248-26-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3592-78-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4408-1-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4408-0-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4408-8-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4864-76-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4864-71-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4880-42-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4880-50-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4984-49-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4984-55-0x0000000000400000-0x0000000000410000-memory.dmp
memory/6028-13-0x0000000000400000-0x0000000000410000-memory.dmp
memory/6028-21-0x0000000000400000-0x0000000000410000-memory.dmp