Analysis
- max time kernel
148s - max time network
132s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
12/08/2026, 03:47
General
- Target 2026-08-12_19f29ffe7e6910bca40ff0039e282d94_elex_remcos_wannacry.exe
- Size 60KB
- Sample260812-eb6r4avvbw
- SHA256 e68712afc34b99f3731ca381bdbab45be0b5c8964a9c8329edc9f09d48f9e7be
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 36 IoCs
- Detects Windows executables referencing non-Windows User-Agents 36 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-12_19f29ffe7e6910bca40ff0039e282d94_elex_remcos_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-12_19f29ffe7e6910bca40ff0039e282d94_elex_remcos_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5BA9F9B4-766D-49f5-B70D-5B6965C637BC}.exeC:\Windows\{5BA9F9B4-766D-49f5-B70D-5B6965C637BC}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D195134B-92D0-405d-B4BA-86685C04BC6F}.exeC:\Windows\{D195134B-92D0-405d-B4BA-86685C04BC6F}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{99F19ABC-170F-426c-A38A-96735378A70F}.exeC:\Windows\{99F19ABC-170F-426c-A38A-96735378A70F}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FF15EB34-BBF3-4383-B8A5-4532325D1FC9}.exeC:\Windows\{FF15EB34-BBF3-4383-B8A5-4532325D1FC9}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{24771CD0-DB6F-4844-897F-C8D90E224BB7}.exeC:\Windows\{24771CD0-DB6F-4844-897F-C8D90E224BB7}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{774813BC-2535-4460-99E1-79C522078EA1}.exeC:\Windows\{774813BC-2535-4460-99E1-79C522078EA1}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F019D33F-35C9-4790-942F-A11E623D7615}.exeC:\Windows\{F019D33F-35C9-4790-942F-A11E623D7615}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B51AE16C-9C79-4a7d-A94C-0E1BF6171A26}.exeC:\Windows\{B51AE16C-9C79-4a7d-A94C-0E1BF6171A26}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DB756A61-EDB3-4e35-9060-D4AD2D390732}.exeC:\Windows\{DB756A61-EDB3-4e35-9060-D4AD2D390732}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2F790633-6618-4428-8B2F-DB0394CED480}.exeC:\Windows\{2F790633-6618-4428-8B2F-DB0394CED480}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{27061E0F-CFCA-4e9e-A22D-6C3FC8FA8000}.exeC:\Windows\{27061E0F-CFCA-4e9e-A22D-6C3FC8FA8000}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2F790~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DB756~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B51AE~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F019D~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{77481~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{24771~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FF15E~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{99F19~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D1951~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5BA9F~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{24771CD0-DB6F-4844-897F-C8D90E224BB7}.exe
{27061E0F-CFCA-4e9e-A22D-6C3FC8FA8000}.exe
{2F790633-6618-4428-8B2F-DB0394CED480}.exe
{5BA9F9B4-766D-49f5-B70D-5B6965C637BC}.exe
{774813BC-2535-4460-99E1-79C522078EA1}.exe
{99F19ABC-170F-426c-A38A-96735378A70F}.exe
{B51AE16C-9C79-4a7d-A94C-0E1BF6171A26}.exe
{D195134B-92D0-405d-B4BA-86685C04BC6F}.exe
{DB756A61-EDB3-4e35-9060-D4AD2D390732}.exe
{F019D33F-35C9-4790-942F-A11E623D7615}.exe
{FF15EB34-BBF3-4383-B8A5-4532325D1FC9}.exe
memory/204-29-0x0000000000400000-0x0000000000410000-memory.dmp
memory/204-34-0x0000000000400000-0x0000000000410000-memory.dmp
memory/800-16-0x0000000000400000-0x0000000000410000-memory.dmp
memory/800-22-0x0000000000400000-0x0000000000410000-memory.dmp
memory/800-14-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1716-43-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1716-48-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2260-12-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2260-6-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2404-62-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2404-57-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2820-78-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2900-7-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2900-0-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2900-1-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3344-64-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3344-69-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4324-27-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4324-21-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4396-55-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4396-50-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4840-41-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4840-36-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5848-71-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5848-76-0x0000000000400000-0x0000000000410000-memory.dmp